Having trouble altering VQL for glob in a CLIENT_EVENT artifact to detect for removeable media only

[spza2929]

I am bouncing my head off the wall trying to understand why this VQL works in one artifact:

    LET removable_disks = SELECT Name AS Drive,
        atoi(string=Data.Size) AS Size
    FROM glob(globs="/*", accessor="file")
    WHERE Data.Description =~ "Removable" 

But when I add that FROM and WHERE clause to the artifact query below it breaks the detection, and no files are found when written to a USB device. The VQL below works, but will detect writes to ANY drive, but I need it to only trigger for removable media (USB /external media).

• query: |
  LET AddedFiles = SELECT OSPath, Size, FullPath
  FROM diff(
  key="Key",
  period=2,
  query={
  SELECT OSPath, Size, FullPath,
  format(format="%v_%v", args=[OSPath, Size, FullPath]) AS Key
  FROM glob(globs=":/")
  })
  WHERE Diff = "added"

  LET FifoQuery = SELECT * FROM fifo(flush=TRUE, query=AddedFiles, max_rows=1000, max_age=60)
  
  SELECT * FROM foreach(row={
  SELECT * FROM clock(start=1, period=25)
  }, query={
  SELECT enumerate(items=OSPath.Basename) AS Files, count() AS Count, FullPath() AS FullPath
  FROM FifoQuery
  GROUP BY 1
  })
  WHERE Count > 10
  

I know I am not good with VQL, but I dont see why this VQL does not work:

• query: |
  LET AddedFiles = SELECT OSPath, Size, FullPath
  FROM diff(
  key="Key",
  period=2,
  query={
  SELECT OSPath, Size, FullPath,
  format(format="%v_%v", args=[OSPath, Size, FullPath]) AS Key
  FROM glob(globs="/*", accessor="file")
  WHERE Data.Description =~ "Removable"
  })
  WHERE Diff = "added"

  LET FifoQuery = SELECT * FROM fifo(flush=TRUE, query=AddedFiles, max_rows=1000, max_age=60)
  
  SELECT * FROM foreach(row={
  SELECT * FROM clock(start=1, period=25)
  }, query={
  SELECT enumerate(items=OSPath.Basename) AS Files, count() AS Count, FullPath() AS FullPath
  FROM FifoQuery
  GROUP BY 1
  })
  WHERE Count > 10
  

I am confused because this VQL does work for removeable media only, but it does not allow for detections based on time:

• query: |
  LET removable_disks = SELECT Name AS Drive,
  atoi(string=Data.Size) AS Size
  FROM glob(globs="/*", accessor="file")
  WHERE Data.Description =~ "Removable" AND Size < atoi(string=maxDriveSize)

  LET file_listing = SELECT FullPath,
      Mtime As Modified,
      Size
  FROM glob(globs=Drive+"\\**", accessor="file")
  LIMIT 1000
  
  LET hostname = SELECT Hostname FROM system()
  
  SELECT *, hostname FROM diff(
    query={
       SELECT * FROM foreach(
           row=removable_disks,
           query=file_listing)
    },
    key="FullPath",
    period=10)
    WHERE Diff = "added"
  

I have tried combining the above two queries in multiple ways, but I just cannot get the last piece working, which is to change the VQL that works for any drive over time, to just be for removable storage. Anyone see something obvious that I am missing? Thank you so much in advance.

[spza2929]

reworded request in another discussion