Glossary
Partition/Diagnostic event 1006
The Windows 10+ event logged on each disk arrival, with model, serial, capacity, partition table and volume boot records.
Microsoft-Windows-Partition/Diagnostic event 1006 is written when a disk arrives, on Windows 10 1703 and later, enabled by default. Its fields include Manufacturer, Model, SerialNumber, ParentId (the USB device), Capacity and the binary Mbr and Vbr0… boot records.
The boot records give the volume serial number. Practitioners report a zero-capacity 1006 on removal. See the 1006 guide.