Windows keeps logs of everything that happens on your computer. And within these logs is a detailed documentation of when USB devices are connected and disconnected.

There are numerous reasons why you might need to see a record of your USB connection history. These include troubleshooting your connected peripherals and checking if someone has attached a storage device without your knowledge. Here are four different ways you can view the USB device history on your Windows PC.

Why Does Windows Log USB Connections?

Windows keeps a record of every USB device that is connected to and unplugged from the computer it is installed on. It does this so that future connections of the same device are recognized and can be completed quickly, without having to install the device every time.

t isn't there to enable you to see the USB devices that have been connected, but when you know how to view these system records, the information is there for you to find.

Using USBDeview to View USB Connections

USBDeview is a small and portable utility that allows you to quickly view the USB connection history of any computer it is running on. As well as showing device history, it will also display all of your currently connected USB devices. You can download USBDeview free of charge from the NirSoft website.

1. After downloading the software, extract it from the zipped folder. USBDeview is a portable application so you don't need to install it before using it.
2. Double-click the USBDeview application file to run the app. It may take a few seconds to populate the list.
3. When the list of USB connections updates, currently connected devices are highlighted in green. Historic connections are left in white.
4. You can click the Connected tab to separate and sort the different connections.
5. Running the app as Administrator allows you to see the time and date the devices were last connected and removed. To see this information, look in the last two data columns.

Viewing USB Connection History Using PowerShell

If you prefer not to use third-party software to see your USB device history, you can use PowerShell instead. You can use PowerShell to query the system registry and produce a list of all USB storage devices currently connected, as well as those previously connected.

If you have never used PowerShell before, you can read more about this useful tool in our guide to Windows PowerShell.

1. Open PowerShell from the main Windows app list. You don't need to open as an administrator, but you can if you wish.
2. To see a user-friendly list of the USB storage devices, enter the command: Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\* | Select FriendlyName

   

3. You can also see the devices listed with a bit more information, but in a less user-friendly way, by typing: Get-ChildItem HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR | Select PSChildname

Bear in mind that these methods query the USBSTOR section of the registry, so only devices that are recognized as USB storage will be shown.

Viewing USB Connection History in the Registry

The PowerShell commands detailed above query the Windows Registry, but if you prefer you can go into the Registry and manually find the information about USB storage connections. This has the benefit of providing more information, which can be useful if you are troubleshooting.

1. Open the Registry Editor by searching for Regedit using Windows Search.
2. Once the Registry Editor is open, you need to navigate to the following address in the sidebar: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
3. The USB devices will be listed in the sidebar. If you expand each one you can find more information about them.

The problem with both this and the PowerShell method is that you won't be able to see when the USB devices were connected or disconnected. But you can see this information in the Windows Event logs.

Viewing USB Connection History With Event Logs

Windows has a built-in event viewer which can be used to view USB connection history. However, it is easier to use a third-party app called FullEventLogView. This small and portable app shows the same information as you would see in the Windows Event Viewer but displays it in a much more user-friendly way. FullEventLogView is a portable app, meaning it doesn't need to be installed before you can use it.

1. Run the app by double-clicking the application file in the downloaded folder.
2. The first time you use the app, it will take several seconds to scan all the event logs that are available.
3. To show only the USB connection events, click Options > Advanced options.
4. In the new window that opens, deselect all Event Levels apart from Information. Then select the date range you want to view logs for.
5. Change Show all event IDs to Show only the specified event IDs and enter 2003,2102. These event IDs are for when USB devices were connected and when they were ejected.
6. Change Show all channels to Show only the specified channels and enter: Microsoft-Windows-DriverFrameworks-UserMode/Operational
7. Click Ok and any events that match your settings will be displayed as a list. The event time column shows when the USB devices were connected and ejected.
8. You can click on any of the events to see a bit more information.

Viewing USB Connection History of Computers on Your Local Network

All the methods detailed above only allow you to see the USB connection history of devices on a single computer. If you want to see the connection history of all computers on a local network, USB History Viewer from intelliAdmin could be the answer.

1. After downloading the app, double-click the EXE file to open it.
2. You need to enter the name of your computer before you can view the USB history. If you don't know the name of your computer, go to Settings > System > About. Your computer name is shown at the top.
3. Click the Start button to see the USB history. You can then expand the results to see details such as the time and date it was last used.
4. If you want to see the USB history of another PC on your local network, you will need to enter the username and password of the computer, as well as its domain on the network. If you are not sure how to find the domain of a computer on your local network, check out these useful networking commands.

Viewing USB Connection History, Made Easy

There are several ways to see the history of USB devices that have been connected and disconnected from your computer. Not all the methods here provide the same amount of information, but each has the potential to be useful for different situations. If you need to see which USB connections have been made, one of these methods is sure to help.