Figure C When you connect a USB flash drive to your system, a number event records are generated in the Operational Log.Īs you can see, the first couple of event records pertain to loading drivers for the particular USB flash drive. These records will consist of the following Event IDs:įor example, when I connected a USB flash drive to my system, Event Viewer displayed those event records in the Operational Log, as shown in Figure C.

When you connect a USB flash drive to your system, a number of Information and Verbose Level event records are generated in the Operational Log. Figure B You must enable the Operational Log before Event Viewer will start capturing USB flash drive related events. When the Log Properties - Operational dialog appears, select the Enable Logging check box, as shown in Figure B. As such, you need to enable it first by drilling down to DriverFrameworks-UserMode, right-clicking on the Operational Log, and then selecting Properties from the context menu. However this log is not enabled by default. Figure A The Overview And Summary panel displays a list of the most recent events.Įvent Viewer will keep track of USB flash drive related events in the Application and Services Logs > Microsoft > Windows > DriverFrameworks-UserMode > Operational As soon as the tool launches, you'll see the Overview And Summary panel, as shown in Figure A, which displays a list of the most recent events collected from all the logs. When Event Viewer appears in the Results pane, just click it. One of the easiest ways is to click the Start button and begin typing Event Viewer. There are several ways to launch Event Viewer. SEE: Digital forensics: The smart person's guide Getting started I'll then show you how to employ these techniques to use Event Viewer to track USB flash drive usage on a system. In this article I'll explain in more detail what I found. I then found out how to identify specific USB flash drives, which allowed me to determine how long a specific USB flash drive was connected to a system. And of course, each of these operations had a date and time stamp. Further investigation and experimentation led me to the Event IDs that correspond to the connection and disconnection operations. I knew that kind of information would be recorded in Windows 10's Event logs, and after some investigation with Event Viewer, I found out where. Checklist: Securing Windows 10 systems (TechRepublic Premium).Ten Windows 10 network commands everyone one should know.A new Microsoft Store: What does it mean for you and your business? A lot, actually.Windows 11 prep: How to convert MBR hard drive partitions to GPT.

Windows 10 eject usb hard drive