Detect If a Flash Drive Was Used - Method # 2

There's a second way to check and see if flash drives have been inserted into your PC, and this technique will show the first time a flash drive has been used with a Windows computer. Check at C:\Windows\inf for a file named, ''. This a text file which can be viewed in NotePad. In the file look for a reference to the brand name of your flash drive. You should see a reference to it on a line that begins, '>>> [Device Install'. The next line will begin, ">>> Section start" and show the date and time the drive was used.

If you can't find any references to the brand name of the flash drive, check for the ID number of the flash drive, if you have it available. Follow these steps:

1. In Windows Explorer right click on Computer and choose 'Properties'.

2. Select 'Device Manager' on the Control Panel list at the left.

3. Look under 'Portable Drives' for a reference to your flash drive.

4. Right and select Propertes.

5. Click on the Details tab.

6. Under Property choose, 'Device Instance Path'. This will show a value that you can right click on and copy.

7. Go back to the C:\Windows\inf\ file and search for the last part of the value, the alphanumeric code after the last underscore. It should appear on a line beginning with '>>> [Device Install '. This will be a reference to the first time the flash drive was used with the PC.

Contact Me With Your Litigation Support Questions:

  • Twitter Long Shadow

© 2015 by Sean O'Shea . Proudly created with