What does windows when a USB memory stick is inserted?

Hi,

I would like to know which event send window when a memory stick is inserted and where does it save this event.
Is there any way to find it?


aquilabiancaAsked:
Who is Participating?
 
GuruGaryCommented:
For a registry key, try:
HKLM\System\CurrentControlSet\Enum\USBStor

If the USBSTOR key does not exist, then it is likely that a USB drive has not been used in that installation of Windows

If it does exist, then there should be a subkey for each USB device plugged in, along with device information.

You can also use Windows 2000 Group Policy to disable using USB storage devices if that helps.

To get the last time a device was plugged in, I think you need to access HKLM\Software\Microsoft\Windows\Shell\BagMRU ... but it appears that is a protected area of the registry which you would need a special program to access.  I will research to see if I can find an alternate location for that information.
0
 
AndreDekoltaCommented:
"I would like to know which event send window"  No sure which event send window do.  I look no find window.  You?  Sorry, my sick humor she no good.  Need more information.  What OS?  What is it that you're trying to do?
0
 
aquilabiancaAuthor Commented:
Even I am not sure if windos send an event, but would like to know if there is any way to find it out if a memory stick has been inserted. Is it stored no where?
0
Cloud Class® Course: SQL Server Core 2016

This course will introduce you to SQL Server Core 2016, as well as teach you about SSMS, data tools, installation, server configuration, using Management Studio, and writing and executing queries.

 
AndreDekoltaCommented:
No, it cannot be used to autorun a program.
0
 
GuruGaryCommented:
Are you asking if Windows sends an Event ID to the Event Logs when a USB Flash device is plugged in?  If that is the question, then there is not an event logged in Windows by default.

There are some registry keys that are updated when removable devices are plugged in.  Would this information help?  If so, what are you trying to learn?  If a particular device was ever plugged in?  Or the last time a device was plugged in?
0
 
aquilabiancaAuthor Commented:
Hi GuruGary,

your answer is getting the things interesting.

Let's make it like this:
I have a computer that I shered with other people. Every body has its own log in. Now, we want to find a system to find it out if somebady is using a USB memory stick to bring outside or inside some files.

We have two option:
1. we can build a program that can store every time some body is using a usb, its user id and the data it happened.
2. we can look as you suggest the registry key.

My task is to find it out all possible way to know wheter somebody has used a USB memory stick.

You said:
there is not an event logged in Windows by default.

then I ask you how to change this default to make window sending an event and what kind of event is sending.

About the registry key I'm interested to both questions:
1) If a particular device was ever plugged in.
2) the last time a device was plugged in.

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.