Figure B You must enable the Operational Log before Event Viewer will start capturing USB flash drive related events. When the Log Properties - Operational dialog appears, select the Enable Logging check box, as shown in Figure B. As such, you need to enable it first by drilling down to DriverFrameworks-UserMode, right-clicking on the Operational Log, and then selecting Properties from the context menu. However this log is not enabled by default. Figure A The Overview And Summary panel displays a list of the most recent events.Įvent Viewer will keep track of USB flash drive related events in the Application and Services Logs > Microsoft > Windows > DriverFrameworks-UserMode > Operational

As soon as the tool launches, you'll see the Overview And Summary panel, as shown in Figure A, which displays a list of the most recent events collected from all the logs. When Event Viewer appears in the Results pane, just click it.

One of the easiest ways is to click the Start button and begin typing Event Viewer. There are several ways to launch Event Viewer. SEE: Digital forensics: The smart person's guide Getting started I'll then show you how to employ these techniques to use Event Viewer to track USB flash drive usage on a system. In this article I'll explain in more detail what I found. I then found out how to identify specific USB flash drives, which allowed me to determine how long a specific USB flash drive was connected to a system. And of course, each of these operations had a date and time stamp.

Further investigation and experimentation led me to the Event IDs that correspond to the connection and disconnection operations. I knew that kind of information would be recorded in Windows 10's Event logs, and after some investigation with Event Viewer, I found out where.

Windows 11: Tips on installation, security and more (free PDF).

Ten Windows 10 network commands everyone one should know.

Why Windows 11's security is such a big deal.

Windows 11 cheat sheet: Everything you need to know.

The last usb device you connected