How to find out when a USB disk was removed in Windows 11/10

For various reasons, one might want to track when a USB flash drive is connected to their computer and when it is removed. However, Windows itself does not offer this option. Thankfully, you can tweak a few settings in the Event Viewer to start tracking it, and here is how to do it.

How to find out when a USB disk was removed in Windows 11/10

There are two ways to track and find out when a USB disk was removed in Windows 11/10:

1. Windows Event Viewer
2. USBDeview by Nirsoft

Make sure to use an administrator account for both.

1] Using Windows EventViewer

Windows logs different activities under event logs, which can be accessed via Event Viewer, including connecting or removing a USB flash drive. But Windows doesn’t track this thing by default. Instead, you will need to enable it first.

• Press Windows + X to access the Quick menu and select Event Viewer.
• Go to the following path: Application and Services Logs > Microsoft > Windows > DriverFrameworks-UserMode
• Right-click on Operational log and select Properties.
• Tick Enable logging, then click Apply > Ok. Once done, Windows will start tracking USB devices on your computer.
• Finally, to find out if any USB flash drive was connected to your system, you must go to the following path again: Application and Services Logs > Microsoft > Windows > DriverFrameworks-UserMode > Operational. Here, you will find different logs with Event IDs: 2003, 2004, 2006, 2010, 2100, 2101, 2105, and 2106.

You can then double-click each event ID to determine which device was connected and the logged date.

Read: How to view and delete Event Viewer Saved Error Logs in Windows

2] Using USBDeview

A simple way to track all the USB devices connected to your system is to use the USBDeview software. It shows a list of all the USB devices connected to your computer and all the USB devices you previously used. You will get extended information for each USB device, including the date/time the device was connected or removed.

• First, download USBDeview from its website and unzip it.
• Double-click on USBDeview, listing all the connected and previously connected USB devices. To find anything suspicious, you will need to go through the log. However, you can sort the log by going to View > Sort by highlighting storage or other devices.
• To find out when a device was connected or removed, double-click on the log and look for Registry Time 1 and Registry Time 2. These will help you know when the device was first connected and when it was removed. If the device is still connected, it will display the current date and time.

The above two methods will help you find all the connected and removed USB devices, including flash drives. However, Event Viewer won’t display past USB-connected devices. USBDview lets you see all the devices connected to or removed from your device.

Read: Remount ejected USB Drive in Windows without physically reconnecting it

Can copying to USB be traced?

Copying files to a USB flash drive can be tracked through Event Viewer logs, auditing file access, or third-party monitoring software.

Read: Erase all traces of old connected USB Drives from Windows PC

How to remove USB history?

You can remove your USB history using USBDview. Open the program and right-click on the device you want to remove. Finally, select Uninstall the selected device to remove the log. This will ensure that all history is removed.