top of page

Detect If a Flash Drive Was Used - Method # 2


There's a second way to check and see if flash drives have been inserted into your PC, and this technique will show the first time a flash drive has been used with a Windows computer. Check at C:\Windows\inf for a file named, 'setupapi.dev.log'. This a text file which can be viewed in NotePad. In the file look for a reference to the brand name of your flash drive. You should see a reference to it on a line that begins, '>>> [Device Install'. The next line will begin, ">>> Section start" and show the date and time the drive was used.

If you can't find any references to the brand name of the flash drive, check for the ID number of the flash drive, if you have it available. Follow these steps:

1. In Windows Explorer right click on Computer and choose 'Properties'.

2. Select 'Device Manager' on the Control Panel list at the left.

3. Look under 'Portable Drives' for a reference to your flash drive.

4. Right and select Propertes.

5. Click on the Details tab.

6. Under Property choose, 'Device Instance Path'. This will show a value that you can right click on and copy.

7. Go back to the C:\Windows\inf\setupapi.dev.log file and search for the last part of the value, the alphanumeric code after the last underscore. It should appear on a line beginning with '>>> [Device Install '. This will be a reference to the first time the flash drive was used with the PC.


 

Sean O'Shea has more than 20 years of experience in the litigation support field with major law firms in New York and San Francisco.   He is an ACEDS Certified eDiscovery Specialist and a Relativity Certified Administrator.

​

The views expressed in this blog are those of the owner and do not reflect the views or opinions of the owner’s employer.

​

If you have a question or comment about this blog, please make a submission using the form to the right. 

Your details were sent successfully!

© 2015 by Sean O'Shea . Proudly created with Wix.com

bottom of page