What does windows when a USB memory stick is inserted?

Posted on 2006-05-30
Last Modified: 2010-04-13

I would like to know which event send window when a memory stick is inserted and where does it save this event.
Is there any way to find it?

Question by:aquilabianca
    LVL 9

    Expert Comment

    "I would like to know which event send window"  No sure which event send window do.  I look no find window.  You?  Sorry, my sick humor she no good.  Need more information.  What OS?  What is it that you're trying to do?

    Author Comment

    Even I am not sure if windos send an event, but would like to know if there is any way to find it out if a memory stick has been inserted. Is it stored no where?
    LVL 9

    Expert Comment

    No, it cannot be used to autorun a program.
    LVL 10

    Expert Comment

    Are you asking if Windows sends an Event ID to the Event Logs when a USB Flash device is plugged in?  If that is the question, then there is not an event logged in Windows by default.

    There are some registry keys that are updated when removable devices are plugged in.  Would this information help?  If so, what are you trying to learn?  If a particular device was ever plugged in?  Or the last time a device was plugged in?

    Author Comment

    Hi GuruGary,

    your answer is getting the things interesting.

    Let's make it like this:
    I have a computer that I shered with other people. Every body has its own log in. Now, we want to find a system to find it out if somebady is using a USB memory stick to bring outside or inside some files.

    We have two option:
    1. we can build a program that can store every time some body is using a usb, its user id and the data it happened.
    2. we can look as you suggest the registry key.

    My task is to find it out all possible way to know wheter somebody has used a USB memory stick.

    You said:
    there is not an event logged in Windows by default.

    then I ask you how to change this default to make window sending an event and what kind of event is sending.

    About the registry key I'm interested to both questions:
    1) If a particular device was ever plugged in.
    2) the last time a device was plugged in.

    LVL 10

    Accepted Solution

    For a registry key, try:

    If the USBSTOR key does not exist, then it is likely that a USB drive has not been used in that installation of Windows

    If it does exist, then there should be a subkey for each USB device plugged in, along with device information.

    You can also use Windows 2000 Group Policy to disable using USB storage devices if that helps.

    To get the last time a device was plugged in, I think you need to access HKLM\Software\Microsoft\Windows\Shell\BagMRU ... but it appears that is a protected area of the registry which you would need a special program to access.  I will research to see if I can find an alternate location for that information.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Enabling OSINT in Activity Based Intelligence

    Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

    Suggested Solutions

    NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
    In the modern office, employees tend to move around the workplace a lot more freely. Conferences, collaborative groups, flexible seating and working from home require a new level of mobility. Technology has not only changed the behavior and the expe…
    Internet Business Fax to Email Made Easy - With eFax Corporate (, you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
    This video discusses moving either the default database or any database to a new volume.

    760 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    8 Experts available now in Live!

    Get 1:1 Help Now