How get time when pen drive or any usb remove or connect in windows


  1. Posts : 4
    Select a State/Province.......
       #1

    How get time when pen drive or any usb remove or connect in windows


    I lost my friend's pen drive at my college lab and now i want to know on which period someone removes it from the system of our lab (Using Windows 7)

    Please some one know is there any way to know when the pen-drive removes from computer so i know which period the other students removed that .

    Please help me .
      My Computer


  2. Posts : 1,686
    Windows 7 x64 Ultimate and numerous virtual machines
       #2

    Hello JeevanjotSingh
    Welcome to Seven Forums.
    You can find the information you are looking for in the Administrative Tools/ Event Log.
    See the blog post about where to look
    Digital Forensics Stream: The Windows 7 Event Log and USB Device Tracking
      My Computer


  3. Posts : 4
    Select a State/Province.......
    Thread Starter
       #3

    Thanks for you advice can you please describe it briefly


    Indianatone said:
    Hello JeevanjotSingh
    Welcome to Seven Forums.
    You can find the information you are looking for in the Administrative Tools/ Event Log.
    See the blog post about where to look
    Digital Forensics Stream: The Windows 7 Event Log and USB Device Tracking
    Hi,
    Thanks for sharing this great article but i can't able to understand some complex words in the forums and it is not fully clear for me .
    Can you please describe me shortly where(Event Viewer) to go and find the name of that log where the usb remove . And then what next,how to find the time of removal of pen-drive(Usb) dows we need to right click on it go properties go details and see the time when it's created (If it is now , can you please tell in some simple brief words , I can't understand it properly )
    Thanks
      My Computer


  4. Posts : 1,686
    Windows 7 x64 Ultimate and numerous virtual machines
       #4

    Start, Search, Event Viewer.
    The records include those with Event ID 2003, 2004, 2005, 2010, 2100, 2105, and more. Some of the generated event records contain identifying information about the USB device that was connected. For example, when viewing an event record with Event ID 2003 using the Windows Event Viewer.
    Click on the FIND on the right hand side and type USB or the numbers above.
    The events will come up one at a time.
      My Computer


  5. Posts : 4,776
    Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
       #5

    USB Deview


    In addition to Indianattone's excellent answer there's easy to use software that can give you USB connected history.

    View any installed/connected USB device on your system

    There's two download links. One for 32bit machines and another for 64bit machines.

    Other than that OSForensics springs to mind but I prefer Nirsoft's product.

    OSForensics - Feature comparision - free edition is okay.

    Check the Recent Activity tab for USB Device History. Of course none of this is of any use if a user has wiped USB history and it doesn't tell you much anyway.
      My Computer


  6. Posts : 4
    Select a State/Province.......
    Thread Starter
       #6

    Awesome , Thanks am i doing right?


    Indianatone said:
    Start, Search, Event Viewer.
    The records include those with Event ID 2003, 2004, 2005, 2010, 2100, 2105, and more. Some of the generated event records contain identifying information about the USB device that was connected. For example, when viewing an event record with Event ID 2003 using the Windows Event Viewer.
    Click on the FIND on the right hand side and type USB or the numbers above.
    The events will come up one at a time.
    Thanks , Now i can find that but am i doing right steps and thanks for you'r help.
    Attached Thumbnails Attached Thumbnails How get time when pen drive or any usb remove or connect in windows-eventview.png  
      My Computer


  7. Posts : 4
    Select a State/Province.......
    Thread Starter
       #7

    I can't use any third party software in lab


    Callender said:
    In addition to Indianattone's excellent answer there's easy to use software that can give you USB connected history.

    View any installed/connected USB device on your system

    There's two download links. One for 32bit machines and another for 64bit machines.

    Other than that OSForensics springs to mind but I prefer Nirsoft's product.

    OSForensics - Feature comparision - free edition is okay.

    Check the Recent Activity tab for USB Device History. Of course none of this is of any use if a user has wiped USB history and it doesn't tell you much anyway.
    Thanks for you'r advice but under rules i am not able to use any other software in lab.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 13:59.
Find Us