Think someone is plugging in a USB device without you knowing? Here’s how to check that on Windows.
Windows keeps logs of everything that happens on your computer. And within these logs is detailed documentation of when USB devices are connected and disconnected.
There are many reasons why you might need to see a record of your USB connection history. These include troubleshooting your connected devices and checking if someone has connected a storage device without your knowledge. Here are four different ways to view USB device history on your Windows PC.
Why does Windows log USB connections?
Windows keeps a record of every USB device plugged into and unplugged from the computer it is installed on. It does this so that future connections of the same device are recognized and can be made quickly, without having to install the device each time.
It’s not there to let you see what USB devices have been plugged in, but when you know how to view those system records, the information is there for you to find.
Using USBDeview to view USB connections
USBDeview is a small, portable utility that allows you to quickly view the USB connection history of any computer it is running on. Along with showing the device history, it will also show all your currently connected USB devices. You can download USBDeview for free from the NirSoft website.
- After downloading the software, extract it from the compressed folder. USBDeview is a portable application so you don’t need to install it before using it.
- Double-click the USBDeview application file to run the application. It may take a few seconds to populate the list.
- When the list of USB connections is updated, currently connected devices are highlighted in green. Historical connections are left blank.
- You can click the Connected tab to separate and sort the different connections.
- Running the app as an administrator lets you see the time and date devices were last connected and removed. To see this information, look in the last two columns of data.
Viewing USB Connection History Using PowerShell
If you’d rather not use third-party software to view your USB device history, you can use PowerShell instead. You can use PowerShell to query the system registry and produce a list of all currently connected USB storage devices, as well as those previously connected.
If you’ve never used PowerShell before, you can learn more about this useful tool in our guide to Windows PowerShell.
- Open PowerShell from the main Windows app list. You don’t need to open as an administrator, but you can if you wish.
- To see a friendly list of USB storage devices, enter the command: Get-ItemProperty -Path HKLM:SYSTEMCurrentControlSetEnumUSBSTOR** | Select FriendlyName
- You can also see the devices listed with a bit more information, but in a less user-friendly way, by typing: Get-ChildItem HKLM:SYSTEMCurrentControlSetEnumUSBSTOR | Select PSChildname
Keep in mind that these methods query the USBSTOR section of the registry, so only devices recognized as USB storage will be displayed.
Viewing USB connection history in the registry
The PowerShell commands detailed above query the Windows registry, but if you prefer, you can access the registry and manually find information about USB storage connections. This has the advantage of providing more information, which can be helpful when troubleshooting.
- Open Registry Editor by searching for Regedit using Windows Search.
- Once the Registry Editor is open, you need to navigate to the following address in the sidebar: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTOR
- USB devices will be listed in the sidebar. If you expand each of them, you will find more information about them.
The problem with this method and the PowerShell method is that you won’t be able to see when the USB devices were connected or disconnected. But you can see this information in Windows event logs.
Viewing USB connection history with event logs
Windows has a built-in event viewer that can be used to view USB connection history. However, it is easier to use a third-party application called FullEventLogView. This small, portable application displays the same information you would see in Windows Event Viewer, but displays it in a much more user-friendly way. FullEventLogView is a portable application, which means there is no need to install it before you can use it.
- Run the application by double clicking on the application file in the downloaded folder.
- The first time you use the application, it will take several seconds to analyze all available event logs.
- To view only USB connection events, click Options > Advanced Options.
- In the new window that opens, deselect all event levels except information. Then select the date range for which you want to view the logs.
- Change Show all event IDs to Show only specified event IDs and enter 2003,2102. These event IDs correspond to when the USB devices were plugged in and when they were ejected.
- Change Show all channels to Show only specified channels and enter: Microsoft-Windows-DriverFrameworks-UserMode/Operational
- Click OK and all events that match your settings will be displayed as a list. The event time column indicates when the USB devices were plugged in and ejected.
- You can click on any of the events to see a bit more information.
Viewing the USB connection history of computers on your local network
All the methods detailed above only allow you to see the USB connection history of devices on a single computer. If you want to see the login history of all computers on a local network, intelliAdmin’s USB History Viewer might be the answer.
- After downloading the application, double-click the EXE file to open it.
- You must enter your computer name before you can view USB history. If you don’t know the name of your computer, go to Settings > System > About. Your computer’s name appears at the top.
- Click it Start button to view USB history. You can then expand the results to see details such as time and date of last use.
- If you want to see the USB history of another PC on your local network, you will need to enter the computer’s username and password, as well as its domain on the network. If you’re not sure how to find the domain of a computer on your local network, check out these helpful network commands.
Viewing USB Connection History, Simplified
There are several ways to view the history of USB devices that have been connected and disconnected from your computer. Not all of the methods here provide the same amount of information, but each has the potential to be useful in different situations. If you need to see what USB connections have been made, one of these methods will definitely help.
USB ports not working? How to Diagnose and Fix the Problem in Windows