What does operational log on USB flash drive show?
While the Operational Log shows USB flash drive connect and disconnect events, that’s not the only USB device information this log displays. It may show event records for other USB devices as well. So just be aware of that as you look through the event records.
How many Event Records does a USB flash drive generate?
However, connecting the USB flash drive generated 16 event records. Fortunately, all the records are generated at the same time, and the majority of the event records contain the unique serial number. Therefore, you need to investigate only one record to get what you need.
Where can I find the serial number of a SanDisk Ultra 3.0 flash drive?
The green highlight shows the coded name for the device: USBSTOR#DISK indicates that this is a USB flash drive, and VEN_SANDISK&PROD_ULTRA tells us that this is a Sandisk Ultra 3.0 USB flash drive. The yellow highlight shows where in the string you can find the device’s unique serial number.
How to tell when a USB flash drive is connected?
When a USB flash drive is connected, the first recorded event record is Event ID 2003. So by noting the date and time stamp assigned to an Event ID 2003 record, you can tell exactly when a USB flash drive was connected to the system.
Where can I see USB devices being connected?
You can see USB devices being connected, as well as see when they are disconnected by using the Event Viewer to parse the: “Microsoft/Windows/DriverFrameworks-UserMode/Operational” event log.
How can I find out when my USB flash drive was connected?
By finding the same unique USB flash drive serial number in corresponding Event ID 2003 and Event ID 2102 event records and then applying some math to the date and time stamp numbers, you can tell exactly how long a particular USB flash drive was connected to your system.
Where do I find USB flash drive event records?
When you connect a USB flash drive to your system, a number event records are generated in the Operational Log. As you can see, the first couple of event records pertain to loading drivers for the particular USB flash drive.