Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: How get time when pen drive or any usb remove or connect in windows

11 Aug 2014   #1
JeevanjotSingh

Select a State/Province.......
 
 
How get time when pen drive or any usb remove or connect in windows

I lost my friend's pen drive at my college lab and now i want to know on which period someone removes it from the system of our lab (Using Windows 7)

Please some one know is there any way to know when the pen-drive removes from computer so i know which period the other students removed that .

Please help me .


My System SpecsSystem Spec
.
11 Aug 2014   #2
Indianatone

Windows 7 x64 Ultimate and numerous virtual machines
 
 

Hello JeevanjotSingh
Welcome to Seven Forums.
You can find the information you are looking for in the Administrative Tools/ Event Log.
See the blog post about where to look
Digital Forensics Stream: The Windows 7 Event Log and USB Device Tracking
My System SpecsSystem Spec
11 Aug 2014   #3
JeevanjotSingh

Select a State/Province.......
 
 
Thanks for you advice can you please describe it briefly

Quote   Quote: Originally Posted by Indianatone View Post
Hello JeevanjotSingh
Welcome to Seven Forums.
You can find the information you are looking for in the Administrative Tools/ Event Log.
See the blog post about where to look
Digital Forensics Stream: The Windows 7 Event Log and USB Device Tracking
Hi,
Thanks for sharing this great article but i can't able to understand some complex words in the forums and it is not fully clear for me .
Can you please describe me shortly where(Event Viewer) to go and find the name of that log where the usb remove . And then what next,how to find the time of removal of pen-drive(Usb) dows we need to right click on it go properties go details and see the time when it's created (If it is now , can you please tell in some simple brief words , I can't understand it properly )
Thanks
My System SpecsSystem Spec
.

11 Aug 2014   #4
Indianatone

Windows 7 x64 Ultimate and numerous virtual machines
 
 

Start, Search, Event Viewer.
The records include those with Event ID 2003, 2004, 2005, 2010, 2100, 2105, and more. Some of the generated event records contain identifying information about the USB device that was connected. For example, when viewing an event record with Event ID 2003 using the Windows Event Viewer.
Click on the FIND on the right hand side and type USB or the numbers above.
The events will come up one at a time.
My System SpecsSystem Spec
11 Aug 2014   #5
Callender

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 
USB Deview

In addition to Indianattone's excellent answer there's easy to use software that can give you USB connected history.

View any installed/connected USB device on your system

There's two download links. One for 32bit machines and another for 64bit machines.

Other than that OSForensics springs to mind but I prefer Nirsoft's product.

OSForensics - Feature comparision - free edition is okay.

Check the Recent Activity tab for USB Device History. Of course none of this is of any use if a user has wiped USB history and it doesn't tell you much anyway.
My System SpecsSystem Spec
12 Aug 2014   #6
JeevanjotSingh

Select a State/Province.......
 
 
Awesome , Thanks am i doing right?

Quote   Quote: Originally Posted by Indianatone View Post
Start, Search, Event Viewer.
The records include those with Event ID 2003, 2004, 2005, 2010, 2100, 2105, and more. Some of the generated event records contain identifying information about the USB device that was connected. For example, when viewing an event record with Event ID 2003 using the Windows Event Viewer.
Click on the FIND on the right hand side and type USB or the numbers above.
The events will come up one at a time.
Thanks , Now i can find that but am i doing right steps and thanks for you'r help.


Attached Thumbnails
How get time when pen drive or any usb remove or connect in windows-eventview.png  
My System SpecsSystem Spec
12 Aug 2014   #7
JeevanjotSingh

Select a State/Province.......
 
 
I can't use any third party software in lab

Quote   Quote: Originally Posted by Callender View Post
In addition to Indianattone's excellent answer there's easy to use software that can give you USB connected history.

View any installed/connected USB device on your system

There's two download links. One for 32bit machines and another for 64bit machines.

Other than that OSForensics springs to mind but I prefer Nirsoft's product.

OSForensics - Feature comparision - free edition is okay.

Check the Recent Activity tab for USB Device History. Of course none of this is of any use if a user has wiped USB history and it doesn't tell you much anyway.
Thanks for you'r advice but under rules i am not able to use any other software in lab.
My System SpecsSystem Spec
Reply

 How get time when pen drive or any usb remove or connect in windows




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Drive Letter - Add, Change, or Remove in Windows
How to Add, Change, or Remove a Drive Letter in Vista, Windows 7, and Windows 8 This will show you how to add, change, or remove a drive letter for any drive installed or connected to the computer in Vista, Windows 7, and Windows 8. You can only assign the letters D to Z to each...
Tutorials
Why can I NOT connect to windows.time.com ??
clock is wrong service is started hit "update now" on "Internet Time" tab in clock settings - timeout. So I go to browser, enter windows.time.com and get timeout - on any/all browsers. why is this? i have win 7 x64 home prem, all up to date.... no errors in the windows log
General Discussion
BSOD every time connect USB storage device to Windows 7 PC
I have a Dell Studio XPS 8000 running Windows 7 Home Premium 64 bit. In March the PC started to BSOD every time a USB storage device was connected to it. Other USB devices like mouse or keyboard did not cause this problem. It happens with two different external hard drives and 7 different USB...
BSOD Help and Support
Remove Windows 7 from Old HDD thats now a slave drive
So I have two hard drives in my PC set up as storage drives,, they are getting full and neither boots anymore nor do I care to have them boot. Id like to delete windows 7 from them both but also keep my files that I have on them without having to transfer everything to a new drive. Is there a way...
General Discussion
Windows Xp, 7 then 8 same hard drive want to remove 8
Ok I was curious wanted to see 8. I created a space on my hard drive installed 8. Now that I have seen it I want to go back. Where is the way back machine! I know I am probably toast. Would like to remove 8 and have my system go back to what it was before. I had the xp 7 choice on boot. Not...
Installation & Setup
How to remove Windows 7 from another hard drive?
I have Windows installed on HDD and then I got a new SSD and installed windows 7 on that one. Now when I boot up it asks me which version of windows I want to boot. How do I remove the version of windows on the HDD? Will the boot screen go back to normal once I remove it? I just want the windows...
Installation & Setup


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 01:23.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App