Click here to Skip to main content
15,878,602 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Hi,

I just wonder about the USB connection, if i got the PC in off and plug in the USB in PC off position and after that will start the PC, will the computer register that an USB is pluged in in the start up scenario, and where will in registrated in windows?

I would like to know if my USB have left my computer or have was inserted in my computer at this date, 20161026 intill 20161124 any driver log, need help to find trace of it.
Driver log maybe?

It lok like lite bit tricky...Not so good on computer, is log paser a download program?
So the driver for USB is not a solution to look at?

Regards

Anders

What I have tried:

Free ware USB forencis, but i will not get all the history of stamp.
Posted
Updated 6-Jan-17 2:19am
v3
Comments
Member 12937061 6-Jan-17 7:29am    
Saw in the replay answear, sandisk are little bit starnge to see in that link you send to mee Jochen.
And it is a sandisk i will check.

1 solution

Initial device detection is performed by USB hubs. When a device is connected to a downstream port of a hub, it changes the data line level which is detected by the hub, stored, and signaled to the host. The host then communicates with the hub to perform further initialisation of the device. Once that is finished, the host can communicate directly with the device.

When switching a PC on it works the same way. Once the hub is powered, it will enable power on the USB lines which will let attached devices power up and register at the hub. The host then queries the hub for attached devices and start further initialisation.

At power up the initial setup is not performed by the operating ystem but by the BIOS (e.g. to allow changing BIOS options using USB keyboards and mice).

The operating system will later upon starting communicate with all hubs sending a reset commands to trigger re-initialisation for every device already connected.

Such reset can be done anytime (re-scan USB devices).

There is no specific timestamp register. It is up to the software controlling the host (BIOS and operating system) to store times of events.

See also USB.org - Documents[^] and USB in a NutShell - Chapter 1 - Introduction[^] .
 
Share this answer
 
Comments
Afzaal Ahmad Zeeshan 6-Jan-17 4:54am    
5ed.
Member 12937061 6-Jan-17 5:57am    
Hi,

I am intrest to find if my USB has left my computer from 20161026 intill 20161124, is it possible to read a log when driver routine comes , a time stamp for it in windows?
Maybe you have another tip?
Jochen Arndt 6-Jan-17 6:29am    
Some operations (especially for USB memory devices) are logged by Windows in the event log at Microsoft - Windows - DriverFrameworks-UserMode - Operational (Win 7).

Insertion of new devices is logged in the installation section.

Maybe this blog is a good starting point (most should also apply to Win 10):
http://dfstream.blogspot.de/2014/01/the-windows-7-event-log-and-usb-device.html

If you need logging of all plug-in and -out events a solution might be writing a service or small application that is auto started, registering for the events, and writing them to your own log file.
Member 12937061 6-Jan-17 8:08am    
But there was a small problem, the sandisk was little bit tricky to see.
I run the orionforensics and try with the sandisk, that registrate when i put in the USB with PC running but if i plug in the USB in off and after run PC it will not be registrate.
Try with another USB and it registrer in both scenario.
Do you know why?
Jochen Arndt 6-Jan-17 8:13am    
Sorry, I don't know why (probably only MS will know).

But I can guess that a plug-in event is handled differently compared to a device attached already upon power on (at least regarding the logging).

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900