title: Determine if NTFS volume was mounted outside
body: <p>I have a software that is tracking an NTFS volume changes on a Windows OS using volume filter driver. I need to handle a condition when the volume gets mounted and modified outside of the OS where my driver is installed. </p>
  
  <p>Is it possible to figure out the "last mount time" of the volume? or any other parameter allowing me to tell if the volume has been mounted outside of my driver control?</p>