How to Search for USB device events

Question

0.00/5 (No votes)

See more:

I need to search for the insertion/ removal time of USB storage devices in a number of clients and store the data on a central SQL DB. I also need the device ID, and VID, so as to have a provision of generating a visual indication at a central panel in case of insertion of specific USB devices on specific clients based on USB Device ID.

To start with, I want to find the list of USB devices inserted and removed. How can I do that with C#/ vb.net?

Posted 26-Mar-14 7:24am

GeoNav

Add a Solution

4 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Sergey Alexandrovich Kryukov · Answer 1 · 2014-03-26T10:07:00

Solution 2

Please see this CodeProject article: Detecting Hardware Insertion and/or Removal[^].

To use it with C#, you still need to have some native code using (maybe just wrappers for the call of raw Windows API) and would need to use P/Invoke:
http://en.wikipedia.org/wiki/P/Invoke[^],
http://msdn.microsoft.com/library/en-us/vcmxspec/html/vcmg_PlatformInvocationServices.asp[^].

There is another way: through WMI (System.Management). But this is a kind of a fake approach: it is simply based on periodic polling the the system. I would not recommend using it for detecting events.

—SA

Posted 26-Mar-14 10:07am

Sergey Alexandrovich Kryukov

Updated 26-Mar-14 10:09am

v2

Comments

Dave Kreskowiak 26-Mar-14 16:51pm

You can detect new "events" (not really what's going on here) so long as there is code constantly running to see them.

Windows itself does not LOG them anywhere, so past "events" are lost forever.

Sergey Alexandrovich Kryukov 26-Mar-14 17:01pm

I don't see where OP requested the LOG. OP could log events by handling them. I agree: yes, by executing some code permanently, but why not? This is just a matter of understanding of the OP's request...
—SA

Dave Kreskowiak 26-Mar-14 18:20pm

That's how I took his last sentence.

Espen Harlinn 26-Mar-14 17:55pm

As good as it gets, OP only need to track the changes :-)

Sergey Alexandrovich Kryukov 26-Mar-14 19:08pm

Yes, I though OP wanted to handle them anyhow...
Thank you.
—SA

GeoNav · Answer 2 · 2014-03-27T00:06:00

Hi all,

Thanks for the advises.

One option I found for getting the list of USB devices connected and removed in the past is from the Windows Event Log. In System Log, under EventID 20001, the detection of USB Devices are available. Please refer Yogesh Khatri http://www.swiftforensics.com/2012/08/tracking-usb-first-insertion-in-event.html[^] and Jason Hale at http://dfstream.blogspot.in/2014/01/the-windows-7-event-log-and-usb-device.html[^]. Thereafter the question is how to get the details I wanted from these Event Log entries, such as device ID, Vendor ID, Time of connection/ disconnection, etc, using C# or vb.net. This post on how to detect insertion of USB stick ?[^] gave me some more directions.

Dave Kreskowiak · Answer 3 · 2014-03-26T07:53:00

Solution 1

Windows doesn't maintain any such log of device insert/removals so your app is dead in the water before you even begin.

Posted 26-Mar-14 7:53am

Dave Kreskowiak

Comments

Sergey Alexandrovich Kryukov 26-Mar-14 16:07pm

Why do you think so? Would you look at my answer then?
—SA

User 59241 · Answer 4 · 2014-03-26T13:33:00

You will have to do some programming to achieve this but all you need is available. This is what happens when USB device is added or removed:
http://blogs.msdn.com/b/usbcoreblog/archive/2009/10/31/how-does-usb-stack-enumerate-a-device.aspx[^]

SA's answer deals with most of it.

Windows 8 adds some things to detect these events. You may use the Windows.Devices.Enumeration.Pnp namespace.
http://msdn.microsoft.com/en-us/library/windows/apps/windows.devices.enumeration.pnp[^]
This will enable you to enumerate a collection of USB devices and to watch for add and removal using PnpObjectWatcher.

This will get you through the USB tasks and you can build on this yourself.

How to Search for USB device events

4 solutions

Solution 2

Solution 4

Solution 1

Solution 3

Add your solution here

Preview 0