DEV Community

Darkssel
Darkssel

Posted on

How to Know If Someone Plugged a USB Into Your Windows PC

#windows #security #usb #monitoring

You left your desk for a few minutes.

You came back.

Everything looked normal.

But something felt off.

You might think:

"Did someone plug something into my PC while I was away?"

It's a valid concern.

A USB drive is small. It takes seconds to plug in. And it can be used to:

  • Copy your personal files
  • Install malware
  • Plant spyware
  • Steal passwords
  • Leave a backdoor for later

The scary part?

Windows doesn't show you a visible alert when a USB device is connected.

Unless you know where to look.

This guide shows you exactly how to check if someone plugged a USB into your Windows PC — and how to monitor USB connections automatically.

Why USB Monitoring Matters

USB devices are one of the most common vectors for data theft and malware.

Here's what can happen with a simple USB drive:

Risk Description
Data theft Someone can potentially copy sensitive files very quickly
Malware installation Auto-run malware infects your PC
Privilege escalation Tools that bypass Windows security
Backdoor installation Remote access for later attacks
Password harvesting Tools that extract saved credentials

Most people don't realize that Windows records USB activity — it's just hidden in system logs and registry entries.

Method 1: Check the Windows Registry

Windows keeps a history of USB devices that have been connected to your PC.

How to check it:

  1. Press Win + R, type regedit, and press Enter
  2. Navigate to: 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
Enter fullscreen mode Exit fullscreen mode
  1. You'll see folders with names like Disk&Ven_...
  2. Each folder represents a USB device that was connected
  3. Check the timestamps to see when each device was last connected

Pro tip: Look for devices you don't recognize. If you see a device with a recent timestamp and you didn't plug it in yourself — that's a red flag.

Important note: Registry timestamps may not always reflect the exact last connection time, but they can provide useful clues, especially when combined with other methods.

Alternative location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB
Enter fullscreen mode Exit fullscreen mode

This shows all USB devices, not just storage devices.

Method 2: Check Windows Event Viewer

Windows logs USB activity in the Event Viewer.

How to check:

  1. Press Win + R, type eventvwr.msc, and press Enter
  2. Go to Windows Logs → System
  3. Click Filter Current Log on the right side
  4. In the Event Sources dropdown, select Kernel-PnP
  5. Click OK
  6. Look for Event IDs related to device connections:
    • Event ID 6416 — External device detected
    • Event ID 2100 — Device connected (varies by version)

What to look for:

  • The time and date of the connection
  • The type of device (flash drive, external hard drive, etc.)
  • Unusual connection times (e.g., 3 AM on a weekend)

Pro tip: Event 6416 is particularly useful because it records when a removable storage device was first connected.

Method 3: Use PowerShell to List USB History

For a faster check, use PowerShell.

How to do it:

  1. Open PowerShell as Administrator
  2. Run this command: 
Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR" -Recurse | 
    ForEach-Object { Get-ItemProperty $_.PSPath } |
    Select-Object FriendlyName, LastWriteTime
Enter fullscreen mode Exit fullscreen mode
  1. You'll see a list of all USB devices with their last recorded timestamp

For a more detailed view:

Get-ChildItem -Path "HKLM:\SYSTEM\CurrentControlSet\Enum\USB" -Recurse |
    ForEach-Object { Get-ItemProperty $_.PSPath } |
    Select-Object FriendlyName, ParentIdPrefix, LastWriteTime
Enter fullscreen mode Exit fullscreen mode

Method 4: Check SetupAPI Logs

Windows also logs USB installations in SetupAPI logs.

How to check:

  1. Navigate to: C:\Windows\INF\setupapi.dev.log
  2. Open the file in Notepad
  3. Search for USB or Device installed
  4. Look for entries with timestamps

What to look for:

  • Recent installations of USB devices
  • Devices you don't recognize
  • Installations that occurred when you weren't using your PC

Note: This file can be large. Use Ctrl+F to search for specific terms.

Method 5: Use Third-Party Tools

If you want a simpler way to view USB history, try:

Tool Description
USBDeview Shows all USB devices ever connected with timestamps
USB Forensic Tracker Tracks USB activity for forensic analysis
NirSoft USBDeview Free tool that displays USB device history in a clean interface

These tools read the same registry data but present it in a user-friendly format.

How to use USBDeview:

  1. Download it from NirSoft (free)
  2. Run it as Administrator
  3. You'll see a list of all USB devices
  4. Check the Last Plug/Unplug column for recent activity

Method 6: Monitor USB Connections in Real-Time

Checking logs after the fact is useful — but it's reactive.

What if you want to know the moment someone plugs in a USB device?

That's where real-time monitoring comes in.

What real-time monitoring can do:

  • Alert you instantly when a USB is connected
  • Log the device name and connection time
  • Send notifications even when you're away from your PC
  • Track USB connections alongside other security events

What If You Want to Monitor USB Connections Automatically?

Manually checking registry, Event Viewer, and logs is time-consuming.

You have to:

  • Open Registry Editor
  • Navigate through folders
  • Check timestamps
  • Cross-reference with Event Viewer

That's why I built SysPulse — a lightweight Windows security monitoring tool.

SysPulse monitors USB connections in real-time and sends instant Telegram alerts.

When someone plugs in a USB device, you get an alert like this:

🔌 USB Device Alert
Device: G:\
Connected at: 14:03:46
Enter fullscreen mode Exit fullscreen mode

SysPulse also monitors:

  • New processes with full file paths
  • CPU and RAM anomalies
  • Startup changes
  • USB connections

It runs silently in the background, uses less than 30MB of RAM, and never touches your personal files.

You can set it up once and let it watch your PC for you.

You can find it at: syspulse.pro

Summary Table

Method Effort Real-Time Best For
Registry (USBSTOR) Medium No Historical check
Registry (USB) Medium No All USB devices
Event Viewer Medium No Detailed logs
PowerShell Low No Quick list
SetupAPI Logs High No Installation history
USBDeview Low No User-friendly view
SysPulse Low Yes Real-time alerts

Red Flags to Watch For

Red Flag What It Means
USB connection at unusual hours Someone accessed your PC when you weren't around
Device you don't recognize An unknown USB was plugged in
Multiple devices in a short time Someone tried multiple USB drives
USB connection after hours Could indicate after-hours access
Device connected and disconnected quickly Someone potentially copied files and left

Final Thought

USB devices are small, fast, and potentially dangerous.

Someone can plug one into your PC and potentially copy your files in a very short time.

Windows records USB activity — but most people don't know where to look.

Start with the simple checks:

  1. Check the registry for recent USB devices
  2. Use PowerShell for a quick list
  3. Review Event Viewer for detailed logs

If you want real-time protection, consider using a monitoring tool like SysPulse.

The key: Don't wait until something happens. Know what's being plugged into your PC.

Have questions or a USB monitoring issue I didn't cover? Drop a comment below — I read every one.

Stay secure!

Top comments (0)