Software to Detect Which External Hard Drives or Flash Drives Were Used on Your PC

There is a free application, called USBDeview which will detect which drives are, or have been connected to your PC. See this site: http://www.nirsoft.net/utils/usb_devices_view.html . The tips from the past two nights are helpful because you can apply forensics techniques directly, but this software can speed up the process, and let you double-check your work. The application is just one .exe file that you can save anywhere on your hard drive and run. It will give several columns of data for each portable device that has ever been attached to your PC, including serial numbers and Vendor IDs (see a list of the latter here.) You may want to focus on the columns named, 'Create Date', and 'Last Plug/Unplug Date' which will show the first and last time devices were used with your PC.

Note that the NirSoft site, and the 'Read Me' text file that comes with zip file containing the .exe file contains a warning, that, "The 'Created Date' column doesn't display correct values on Windows 7/8/Vista/2008.". I also believe that I noticed the dates in the C:\Windows\Inf\setupapi.dev.log being off a day or two. So perhaps the real tip here is when your side, or another party is offering evidence of when drives were used with a PC, be aware of the possibility of a discrepancy that may have gone unnoticed by others be could be crucial.