```#event_simpleName=FsVolumeMounted
| bitfield:extractFlags(
 field=VolumeDeviceCharacteristics,
  output=[
    [0,FILE_REMOVABLE_MEDIA],
    [1,FILE_READ_ONLY_DEVICE],
    [2,FILE_FLOPPY_DISKETTE],
    [3,FILE_WRITE_ONCE_MEDIA],
    [4,FILE_REMOTE_DEVICE],
    [5,FILE_DEVICE_IS_MOUNTED],
    [6,FILE_VIRTUAL_VOLUME],
    [7,FILE_AUTOGENERATED_DEVICE_NAME],
    [8,FILE_DEVICE_SECURE_OPEN],
    [9,FILE_CHARACTERISTIC_PNP_DEVICE],
    [10,FILE_CHARACTERISTIC_TS_DEVICE],
    [11,FILE_CHARACTERISTIC_WEBDAV_DEVICE],
    [12,FILE_CHARACTERISTIC_CSV],
    [13,FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL],
    [14,FILE_PORTABLE_DEVICE]
])
```

Bitmask value documentation [here](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/616b66d5-b335-4e1c-8f87-b4a55e8d3e4a).