How do you catch if somebody has unplugged USB you just plugged while you were away because it was plugged in already when you came back ? Or How do you find if people have used USB on your computer and how long it was connected ?
This is practically impossible for users unless you can use a monitoring apps of one such app is USB Log View. This app tracks and records any USB which is connected to Windows with details on :
- When it was plugged and unplugged.
- Name of the Device with Description if available. This is usually for USB devices which are setup professionally, for general USB drives this might be empty.
- Technical details such as Device Type, Drive Letter, Serial Number, Vendor ID, Product ID, Vendor Name, Product Name, Firmware version.
- All the logs can be exported in HTML format with options to choose what details will be exported.
- This app can run on system tray which makes it almost invisible for anybody to notice.
Now since just knowing if a USB was inserted is not enough unless you can catch a person red-handed and prove it, I will suggest you to use Directory Watcher Tool to watch the files logs which can be recorded in real-time. This can monitor any folder for which a path is set and includes a backup tool also.
Now if you are wonder how we will get to know the drive letter which is required for the above said tool. Answer to this is not 100% perfect but since any USB plugged gets the next drive assigned which is fixed. What you can do here is setup the Watcher tool to watch on that drive and anybody plugins a USB and you will get to know what is going on in that USB.