Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
You can check for signs that a USB device was connected by comparing Windows Event Viewer logs, the SetupAPI device-installation log, and USB-related registry records. Windows does not keep one guaranteed, undeletable history of every connection: each source records different events, may retain them for different lengths of time, and can be missing or incomplete.
What can Windows records tell you about a USB connection?
Windows stores USB-related evidence in several places, and those records answer different questions. Event logs may show a device event at a particular time; SetupAPI records installation or driver-configuration activity; registry entries can identify a device and, on supported Windows versions, preserve first-install and last-arrival or last-removal bookends.
As an Amazon Associate I earn from qualifying purchases.
These sources are most useful when identifiers match across them. A vendor or product name alone may not be enough to establish that two records refer to the same physical device; compare the device instance ID, serial-related information, or other matching identifiers where available.
- Event Viewer: individual system or device events, if the relevant channel recorded them and the log still retains them.
- SetupAPI.dev.log: installation and configuration activity, not a complete account of every later plug-in or removal.
- Registry: device identity, certain connection-related bookends, and volume or drive-letter mappings—not a guaranteed list of every connection.
A missing record is not proof that the device was never connected. A channel may not have been enabled, a log may have been cleared or overwritten, and Windows updates can affect which artifacts remain.
#1 Best Overall
- USB-C 2-in-1 storage OTG: The Lexar JumpDrive Dual Drive D40E features USB Type-A and Type-C connectors in a slim, portable form factor for easy device compatibility
- Transfer speeds up to 100MB/s: Based on internal testing, performance may vary depending upon the host device, interface, and usage conditions. 1MB=1,000,000 bytes
- Plug and Play: Widely compatible with USB Type-C smartphones, tablets, laptops, Macs, and traditional Type-A devices, no software installation required. The 360° swivel design allows for easy switching between connectors without the hassle of losing a cap
- Durable & Compact: The Lexar D40E USB memory stick features a metal enclosure, withstands temperatures from 0° to 50° C (32°F to 122°F), and is lightweight at 26g with dimensions of 70.4 x 16.9 x 11.7mm
- Security & Warranty: Securely protects files using an advanced security software solution with 256-bit AES encryption. Backed by a Lexar 3-year limited warranty
Which Windows source should you check first?
Start with Event Viewer if you need a particular event time, then use SetupAPI and the registry to look for matching device identifiers and supporting installation or mapping records. No single source is authoritative for every question.
| Source | Evidence type | Time information | Retention after removal | Windows support and practical limits | Inspection difficulty |
|---|---|---|---|---|---|
| Event Viewer | Individual system or device events | Event timestamps, when an event was recorded | Depends on channel configuration and whether the log has rolled over or been cleared | Partition/Diagnostic event 1006 is identified as connection or disconnect evidence on Windows 10 and later; Kernel-PnP events 400 and 410 can provide device-start or configuration evidence. Availability varies. | Moderate: locate the channel, narrow the time range, and filter by provider or event ID. |
SetupAPI.dev.log |
Device installation and driver configuration | Section-start times; timestamps are in the host’s local time | Can retain installation information, but does not record every later insertion and removal | Microsoft documents this log for Windows Vista and later. The default location is %SystemRoot%inf. |
Low to moderate: open a text file and search for identifiers. |
| USBSTOR registry key | Device identity and certain connection-related bookends | On supported Windows versions, numbered properties can represent first installation and last arrival or removal | May retain these bookends after disconnection; does not preserve every plug-in | Relevant properties and their interpretation depend on the Windows version. The records are not a complete connection ledger. | Moderate: locate the device subkey and identify the relevant properties carefully. |
| MountedDevices and per-user MountPoints2 | Volume or drive-letter mapping and possible association with a user session | These are mapping records, not a complete timeline of connection events | May help identify a mounted volume or user association; a mapping is not proof of every use | Interpret alongside device identifiers and other records; mappings alone do not establish when every connection occurred. | Moderate to high: registry inspection and careful identifier matching are needed. |
The Windows-version and artifact descriptions above reflect Microsoft Learn’s documentation for SetupAPI device-installation log entries and the Windows Forensics and Everything-DFIR references for USB artifacts and event logs. They describe evidence types, not a guarantee that a particular PC contains every record.
Free tools Windows power users keep installed
One-click scans. No signup required.
How do you check USB events in Event Viewer?
Filter the relevant logs to a short time window and look for device-related providers and event IDs. A narrow window makes it easier to compare the result with the other Windows records.
Rank #2
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
- Open Event Viewer from the Start menu.
- Inspect Windows Logs > System for device-related entries around the time in question.
- Also inspect Applications and Services Logs > Microsoft > Windows > Partition > Diagnostic, if that channel is present and has events. The forensic references identify event ID 1006 in
Microsoft-Windows-Partition/Diagnosticas possible connection or disconnect evidence on Windows 10 and later. - Look for Kernel-PnP configuration events 400 and 410 as possible device-start or configuration evidence. Their availability and usefulness depend on the channel and system.
- In the relevant log, use Filter Current Log to narrow the time range and, where applicable, filter by provider or event ID. Open matching events and compare their device details with identifiers found in the other records.
Do not treat an event ID as a stand-alone verdict. A matching timestamp can support a connection timeline, but confirm that the event concerns the device you are investigating and distinguish an event that suggests a start or configuration from one that indicates a connection or disconnection.
What if the channel or event is missing?
The channel may be unavailable on that Windows version, may not have recorded the event, or may no longer retain it. Continue with the SetupAPI log and registry records; the absence of an Event Viewer result does not show that no USB connection occurred.
How do you search the SetupAPI device-installation log?
Open %SystemRoot%INFSetupAPI.dev.log in a text editor and search for a device identifier or USB storage entry. This log is useful for installation and configuration history, but it should not be read as a record of every time an already-installed device was plugged in.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- What You Get - 2 pack 64GB genuine USB 2.0 flash drives, 12-month warranty and lifetime friendly customer service
- Great for All Ages and Purposes – the thumb drives are suitable for storing digital data for school, business or daily usage. Apply to data storage of music, photos, movies and other files
- Easy to Use - Plug and play USB memory stick, no need to install any software. Support Windows 7 / 8 / 10 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, compatible with USB 2.0 and 1.1 ports
- Convenient Design - 360°metal swivel cap with matt surface and ring designed zip drive can protect USB connector, avoid to leave your fingerprint and easily attach to your key chain to avoid from losing and for easy carrying
- Brand Yourself - Brand the flash drive with your company's name and provide company's overview, policies, etc. to the newly joined employees or your customers
- Open File Explorer and enter
%SystemRoot%INFin the address bar. - Open
SetupAPI.dev.login a text editor. - Search for
USBSTOR, the device instance ID, a VID/PID, or a serial string if you have one. - Review the surrounding section, including its section-start time and device details. Check whether the identifiers match the device you are trying to identify.
- Compare the section with any candidate Event Viewer events and registry records. SetupAPI timestamps are recorded in the host’s local time, so account for the computer’s time zone when comparing them with times from another source.
Microsoft documents SetupAPI device-installation information in this log for Windows Vista and later. A section is evidence of installation or driver-configuration activity; it does not by itself establish every subsequent connection, removal, or use of the device.
How do you inspect USBSTOR and mounted-volume registry records?
Use Registry Editor to look for the device under HKLMSYSTEMCurrentControlSetEnumUSBSTOR, then compare any matching information with volume mappings. Registry data can help identify a device and certain connection-related bookends, but interpretation depends on Windows version and does not yield a complete plug-in history.
- Open Registry Editor by searching for Registry Editor in Start. Be careful not to change or delete values while inspecting.
- Navigate to
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTORand look for vendor, product, revision, and serial-related subkeys that match the device. - On supported Windows versions, forensic references describe numbered properties under a USBSTOR device key:
0064can represent first installation, while0066and0067can represent last arrival and last removal. Do not assume those meanings apply identically on every Windows version or that they enumerate all connections. - Check
HKEY_LOCAL_MACHINESYSTEMMountedDevicesfor volume or drive-letter mappings that may correspond to the device. - If user-session context matters, inspect the relevant user’s
MountPoints2records for a possible association between that user session and a mounted volume. - Compare identifiers across the registry, SetupAPI, and Event Viewer. A volume mapping can help with identification, but is not itself a timestamped record of every connection.
Registry values can be easy to misread, especially when they contain encoded or binary data. If you cannot confidently interpret a property, record the key and value as supporting evidence rather than converting it into a precise date or claim.
Rank #4
- GOOD VALUE PACKAGE - 1 Pack 32GB Memory Stick USB 2.0 Flash Drives with great cost performance and high quality.
- BIG CAPACITY - The available capacity: 29.10GB-29.8GB, You can save the data of movies, music, photos, designs, programs, manuals, handouts in a high speed.Good performance in digital data storing, transferring and sharing with families, friends, workmates, clients and machines.
- EASY TO USE & PLUG AND WORK - Support windows 7 / 8 / 10 / Vista / XP / 2000 / ME / NT Linux and Mac OS, Compatible with USB2.0 and below.
- TWISTTURN DESIGN & EASY CARRY - The metal clip rotates 360° round the ABS plastic body which with rubber oil skin feeling finish. The capless design can avoid lossing of cap, and providing efficient protection to the USB port.
- WARRANTY & SUPPORT - SIMMAX logo is laser printed on the USB connector surface, our products are of good quality and we promise that any problem about the product within one year since you buy.
How can you validate the workflow on your own PC?
A controlled test with a USB flash drive lets you see which records your Windows installation actually creates. It also helps distinguish a missing artifact on your system from an incorrect search.
- Note the device label and serial number if visible, and record the current time.
- Connect the drive once, wait for Windows to recognize it, then disconnect it.
- Check Event Viewer around that time, filtering the relevant channels and inspecting any matching events.
- Search
%SystemRoot%INFSetupAPI.dev.logforUSBSTORor a matching device identifier. - Inspect the USBSTOR and MountedDevices registry locations for matching device details or volume mappings.
- Compare the event timestamps, SetupAPI section-start time, registry properties, and identifiers. Note which sources recorded evidence and which did not.
Use this test to learn how your own system records a known connection—not to infer that another device’s missing entry proves it was never connected.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should you interpret conflicting or incomplete records?
Prefer a conclusion supported by matching identifiers and more than one kind of evidence. If timestamps or records disagree, describe the specific records rather than forcing them into a complete timeline.
Best Value
- 【16GB Flash Drive】USB flash drives with 16GB capacity, meet your needs of daily use on work, school, home and travelling for photos, music, videos, files storage and transfer. IMEASON thumb drives can be used to store different files, easy to data backup.
- 【Metal Swivel Cap Design】USB thumb drive is metal swivel cover provides extra protection for the usb thumbdrive connector, no usb drive cap to lose; keychain design makes it easier to carry without worrying lose it.
- 【Wide Compatibility】USB drive supports Windows 7/8/10/11 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, also Supports USB 2.0 and 1.1 ports. USB Stick support TV, desktop, notebook computer, car, audio and other device. The USB Memory Stick is your great data storage and transfer companion with traveling and working.
- 【Easy to use】usb memory stick is plug and play without any software installation. Just simply plug the Flashdrive into the port of your USB-compatible devices such as computer, laptop to start data storage or transmission.
- 【What You Get】16 GB USB Flash Drive Thumb Drive, The default format of the usb storage flash drive is FAT32.
- Event Viewer shows an event, but SetupAPI has no new section: the event may concern an already configured device, or the log may not preserve a corresponding installation entry.
- SetupAPI has an installation section, but no event appears: installation evidence does not require a matching event to remain in the logs.
- The registry shows a device, but no recent timestamp: identity or bookend records can remain without documenting each later connection.
- A drive-letter or volume mapping appears without a clear device match: treat it as a possible mapping, not proof that a particular physical drive was connected at a particular time.
- No records match: logs may have rolled over, been cleared, or not been configured to capture the event; feature updates may also affect retained artifacts.
These artifacts can support a basic local check, but they are not an undeletable audit trail. For a consequential investigation, preserve the relevant logs and registry data and seek qualified forensic help rather than relying on one entry or an absence of entries.
Frequently Asked Questions
Can Windows show whether someone copied files from a USB drive?
The USB connection records described here show device, installation, event, or mounting evidence; they do not by themselves establish that files were copied. File access or copying requires separate evidence, and whether it exists depends on the system’s auditing and other records.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteDoes Windows 11 record USB connection history?
The cited forensic references identify Partition/Diagnostic event 1006 as relevant on Windows 10 and later, but whether it is present on an individual Windows 11 PC depends on channel availability and retention. SetupAPI and registry artifacts can also vary in what they preserve.
Can I use these records to identify the person who plugged in a USB device?
A device record can sometimes be associated with a user session through per-user MountPoints2 data, but that association is not conclusive proof of who physically connected it. Interpret it with other evidence and the context of the computer.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
