How to check which USB sticks have been connected to the PC: Do you suspect that someone, and especially your brother, has “stolen” some files from your PC by transferring them to a USB stick? Well, at this point you could make a good scene and make the whole neighborhood participate or – perhaps better – you could start to investigate a bit and find out if someone has actually connected a USB stick to the computer while you were not at home. How? If you want, I’ll explain it right away.
If you have five minutes to spare – but maybe even less -, I can explain how to check which USB sticks have been connected to the PC in order to know if and which pen drives have been connected to the computer in the last few days: a simple operation, almost trivial, but undoubtedly effective if your intent is to demonstrate the “guilt” of people who should not have access to your computer.
So, did I convince you? Do you think that the solution I have proposed is the one that best suits your needs? Perfect, then let’s not waste any more time chatting and let’s go straight to the action! Carefully evaluate the solutions listed below, choose the one you think is simpler and / or more comfortable to use and use it to “frame” your brother or anyone who has taken the bad habit of “stealing” files from your PC without permission!
Check the USB sticks connected to the PC
Do you use a PC equipped with Windows ? Then I have excellent news to give you: you can control the USB sticks connected to the computer using more than one solution. You just have to choose the one that seems best suited to your needs.
USBDeview is certainly the simplest and most effective solution for controlling USB sticks connected to the PC . It is, in fact, a free “program” which, without even requiring an installation, allows you to view the list of USB devices recently connected to the computer and find out the date of their last use. How can you get it? I’ll tell you right away.
First of all, connect to this web page , get to its final part and click on the item Download USBDeview if you use a 32-bit operating system or on the item Download USBDeview for x64 systems if you use a 64-bit operating system. While you’re at it, also click on the Italian item , in order to also download the Italian translation package for the program interface.
When the download is complete, extract the two downloaded archives in the same folder and open the USBDeview.exe program . The program shows the USB devices that are connected to your computer (green) and those that have been in the past (gray).
Click on the Device type column and focus on the devices defined as Mass storage (= USB sticks). These are the ones that interest you. For each USB flash drive, USBDeview reports important information, such as when they were first connected to your PC ( Creation date ) and their last connection, if they are connected, or disconnected ( Date of the last connection / disconnection ) . If among the USB flash drives listed, there are some that are not yours, by crossing the available data, you can understand who inserted it.
If you need it, know that by right clicking on the name of a stick in USBDeview you can also disconnect it from the PC, uninstall it (in order to make it “forget” Windows) and change its drive letter. By going instead, in the Options menu at the top you can enable or disable the display of devices without drivers , USB hubs and devices disconnected from the computer.
If the list of USB devices recently connected to your PC is very long, you can search for the name of one of them and find it quickly by calling the Find function from the Edit menu (top left).
Note: if USBDeview does not work properly on your PC, try to run it as administrator, right-clicking on its icon and selecting Run as administrator from the menu that appears. Alternatively, you can also start the program and select the item Run as administrator from the Help menu located at the top.
If you cannot (or do not want) to use USBDeview, you can control the USB sticks connected to your PC using the Windows Event Viewer , in which all the system events are listed, such as opening programs errors, printing documents and connecting or disconnecting external devices.
To enable the tracing of USB sticks in the Event Viewer, click on the Windows Start button (the flag icon located in the lower left corner of the screen), search for “event viewer” in the menu that appears on the screen and click on the first search result.
In the window that opens, use the side navigation bar to go to the path Applications and services logs> Microsoft> Windows> DriverFrameworks-UserMode> Operative , right click on the Operational icon and select the Properties item from the menu that appears.
At this point, put the check mark next to Enable recording , click the OK button and the Windows Event Viewer will begin to record all connections and disconnections of USB devices.
Subsequently, to find the list of events related to USB devices, all you have to do is go to the path Application and Service Logs> Microsoft> Windows> DriverFrameworks-UserMode> Operator of the Event Viewer and look for the items identified by the codes 2003 , 2004 , 2006 , 2010 , 2100 , 2101 , 2102 , 2105 and 2106 .
To know the details of each event, for example the date on which it occurred or the name of the USB drive connected to the computer, you must click on its title and consult the General tab at the bottom.
If you want to quickly filter the events related to USB devices, you can create a personalized view and thus obtain a list that includes only certain events, for example those with the code 2003 and 2102 , which concern the connection and disconnection of the new USB devices. To create your personalized view, right click on the Operational icon and select the Create custom view item from the menu that appears.
In the window that opens, type the event codes to be displayed (e.g. 2003,2102 ) in the Include / Exclude event ID field and click the OK button . Then type the name you want to assign to the list of events to be created and press OK to save the changes. From this moment on, you can view the events related to USB devices by simply opening the Windows Event Viewer and selecting your personalized list from the left sidebar.
Check the USB sticks connected to the Mac
If you use a Mac , unfortunately you cannot count on a convenient and easy-to-use application such as USBDeview, but you can take advantage of the macOS Console , which on Apple systems performs more or less the same role that the Event Viewer has on Windows. Its consultation is not very simple, moreover the history of events is automatically deleted every week, but on Mac it is not easy to find better solutions.
If, therefore, you want to try to check the history of the USB sticks connected to your Mac, open the Launchpad (the rocket icon located on the Dock bar), select the Other folder from the screen that opens and click on the icon of the Consul . Alternatively, call up the Spotlight search bar by pressing the key combination cmd + space on the Mac keyboard or by clicking on the magnifying glass icon located at the top right (next to the system clock) and look for the Console in the latter.
In the window that opens, select the name of your computer (eg, MacBook of [your name] ) or the entry system.log from the left sidebar, type the term “usb” in the bar located at the top right and press the Enter key on your computer keyboard: in this way you will be shown all the events connected to USB devices (they should be those marked with the USBMSC code ).
To know the details of each event, click on its title and consult the box that appears at the bottom.