Windows 7: Need help with some detective work.

Hey guys.



Anyone know if it's possible to see wich USB drives has been connected to your computer, and to see wich files an unauthorized user may have copied?

I do not know if that is possible.

To my knowledge, there is currently no default way of doing that at this time.

I believe you would need some intrusion software installed on your computer, maybe Symantec Endpoint Protection, or any Intrusion Detection software that would monitor connection of USB devices. You would also have to configure it to log it.

As for seeing what files were copied, that is difficult without another sort of logging program, but I have not investigated far enough to know which ones you can look into to do such a thing at this time.

i dont no if this can help?
View any installed/connected USB device on your system

You can also enable the system variable show_nonpresent_devices.

Right-click Computer.
Click Properties.
Click the Advanced system settings.
Click the Environment Variables tab.
Set the new variable in the System Variables box.

variable: devmgr_show_nonpresent_devices
value: 1

NOTE: You must first select show hidden devices on the Device Manager View menu before you can see devices that are no longer present in the system.

Right.. Thanks ppl. Guess this will teach me to protect my data better next time.

When you say 'protect your data'... Consider this.

One - If this is a computer in a corporate environment, always lock your station when you walk away from it. You do this with Ctrl-Alt-Delete. It is highly recommended as you are held responsible for whatever happens under your login.

Two - Medium to Large corporation enterprises with managed AV support should have intrusion protection measures in place to prevent that. For home situations, you just have to make sure no one can access your machine without knowledge, which includes putting a password protection on it.

Three - Consider using Bitlocker if you are on Windows 7 Ultimate or encryption based software to secure your data. Drawback to this, is that by doing so, you can potentially lock yourself out of your own data depending on the encryption method and if your computer decides to go boom on you.

In a home environment, the simple way to protect against this is to password your User account, then enable the Guest account for others to use. Or create them a standard user account without sharing your files.

Files you want to keep private can be zipped up and passworded using SevenZip. Recycle the original.