Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: Need help with some detective work.

29 Sep 2010   #1

Win 7 Ultimate
Need help with some detective work.

Hey guys.

Anyone know if it's possible to see wich USB drives has been connected to your computer, and to see wich files an unauthorized user may have copied?

My System SpecsSystem Spec

29 Sep 2010   #2

Dual-boot: Windows 7 HP 32-bit SP1 & Windows XP Pro 32-bit SP2.

I do not know if that is possible.
My System SpecsSystem Spec
29 Sep 2010   #3

Windows 7 Ultimate x64 and Home Premium x64

To my knowledge, there is currently no default way of doing that at this time.

I believe you would need some intrusion software installed on your computer, maybe Symantec Endpoint Protection, or any Intrusion Detection software that would monitor connection of USB devices. You would also have to configure it to log it.

As for seeing what files were copied, that is difficult without another sort of logging program, but I have not investigated far enough to know which ones you can look into to do such a thing at this time.
My System SpecsSystem Spec

29 Sep 2010   #4

Operating System : Windows 7 Home Premium Edition 6.01.7600 SP1 (x64)

Attached Thumbnails
Need help with some detective work.-usb.png  
My System SpecsSystem Spec
29 Sep 2010   #5

Windows 7 x64 Ultimate SP1

You can also enable the system variable show_nonpresent_devices.

Right-click Computer.
Click Properties.
Click the Advanced system settings.
Click the Environment Variables tab.
Set the new variable in the System Variables box.

variable: devmgr_show_nonpresent_devices
value: 1

NOTE: You must first select show hidden devices on the Device Manager View menu before you can see devices that are no longer present in the system.
My System SpecsSystem Spec
29 Sep 2010   #6

Win 7 Ultimate

Right.. Thanks ppl. Guess this will teach me to protect my data better next time.
My System SpecsSystem Spec
29 Sep 2010   #7

Windows 7 Ultimate x64 and Home Premium x64

When you say 'protect your data'... Consider this.

One - If this is a computer in a corporate environment, always lock your station when you walk away from it. You do this with Ctrl-Alt-Delete. It is highly recommended as you are held responsible for whatever happens under your login.

Two - Medium to Large corporation enterprises with managed AV support should have intrusion protection measures in place to prevent that. For home situations, you just have to make sure no one can access your machine without knowledge, which includes putting a password protection on it.

Three - Consider using Bitlocker if you are on Windows 7 Ultimate or encryption based software to secure your data. Drawback to this, is that by doing so, you can potentially lock yourself out of your own data depending on the encryption method and if your computer decides to go boom on you.
My System SpecsSystem Spec
29 Sep 2010   #8
Microsoft MVP


In a home environment, the simple way to protect against this is to password your User account, then enable the Guest account for others to use. Or create them a standard user account without sharing your files.

Files you want to keep private can be zipped up and passworded using SevenZip. Recycle the original.
My System SpecsSystem Spec

 Need help with some detective work.

Thread Tools

Similar help and support threads for2: Need help with some detective work.
Thread Forum
The PC Detective? Software
Solved Multiple BSODs--Detective work needed BSOD Help and Support
Solved Need Detective Drivers
Solved Has anybode use Drive Detective?? Drivers
Is Driver Detective worth it? Drivers

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 12:12 AM.
Twitter Facebook Google+

Windows 7 Forums

Seven Forums Android App Seven Forums IOS App

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33