PS P:\sql\data> Get-EventLog -LogName System -Message *surprise*

   Index Time          EntryType   Source                 InstanceID Message
   ----- ----          ---------   ------                 ---------- -------
   25018 Nov 03 13:35  Warning     disk                   2147745949 Disk 3 has been surprise removed.
   24994 Nov 03 13:25  Warning     disk                   2147745949 Disk 6 has been surprise removed.