Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Windows does not keep one guaranteed, undeletable USB plug-in ledger. To reconstruct a device’s history without installing software, correlate three built-in evidence sources: Event Viewer for individual connection-related events, %SystemRoot%INFSetupAPI.dev.log for installation and driver activity, and registry keys for device identity, volume mappings, and first/last arrival or removal properties. Together they can show that Windows recognized a particular USB device and approximately when, but a missing record never proves the device was never connected.
What USB history can Windows show without extra software?
Windows distributes USB evidence across logs and registry locations, and each source answers a different question. Event logs can contain a time-stamped arrival, removal, or device-configuration event. SetupAPI records the installation and configuration of a device or driver. The registry preserves identifiers such as the USB vendor, product, revision, and serial-related subkeys, plus mappings between a mounted volume and a drive letter.
These records are complementary rather than interchangeable:
- Event Viewer: best for individual events in a particular time window, when the relevant channel was enabled and has not rolled over.
- SetupAPI.dev.log: best evidence that Windows installed or configured a device, not a complete list of every later insertion and removal.
- USBSTOR and related registry keys: best for identifying a storage device and checking first-install or supported last-arrival/last-removal bookends.
- MountedDevices and MountPoints2: useful for associating a volume or drive letter with a system or user session; they are not connection-event logs.
Windows version and log-retention state matter. The event IDs and registry properties described below are useful on supported Windows 10 and later configurations, while SetupAPI logging applies to Windows Vista and later. Channels can be disabled, logs can be cleared or overwritten, and feature updates can change which artifacts remain.
#1 Best Overall
- USB-C 2-in-1 storage OTG: The Lexar JumpDrive Dual Drive D40E features USB Type-A and Type-C connectors in a slim, portable form factor for easy device compatibility
- Transfer speeds up to 100MB/s: Based on internal testing, performance may vary depending upon the host device, interface, and usage conditions. 1MB=1,000,000 bytes
- Plug and Play: Widely compatible with USB Type-C smartphones, tablets, laptops, Macs, and traditional Type-A devices, no software installation required. The 360° swivel design allows for easy switching between connectors without the hassle of losing a cap
- Durable & Compact: The Lexar D40E USB memory stick features a metal enclosure, withstands temperatures from 0° to 50° C (32°F to 122°F), and is lightweight at 26g with dimensions of 70.4 x 16.9 x 11.7mm
- Security & Warranty: Securely protects files using an advanced security software solution with 256-bit AES encryption. Backed by a Lexar 3-year limited warranty
How do I make a controlled USB test before investigating an old connection?
A known test connection lets you learn how the current Windows installation records the device before interpreting an older, uncertain timeline. A USB flash drive is practical because it normally creates recognizable storage-device identifiers, but any USB storage device that Windows can detect will work.
- Record the device label and, if it is visible in File Explorer or Device Manager, its serial number. Write down the computer’s current local time, including the time zone if you are comparing records from another system.
- Connect the device once. Wait until Windows finishes recognizing it and, if it is a storage device, until its volume appears in File Explorer.
- Leave the device connected briefly, then use the normal Windows eject command when available and disconnect it.
- Immediately inspect Event Viewer for that narrow time window, then search SetupAPI and the registry for the same device identifiers.
- Compare the event times, the SetupAPI section-start time, the USBSTOR properties, and any drive-letter or volume mapping. Save notes or screenshots before changing filters or removing the test device.
The test does not create a permanent audit trail; it only demonstrates which artifacts this installation currently produces. If the expected event is absent during the controlled test, treat older event-log gaps with extra caution.
How do I find USB connection events in Event Viewer?
Use a narrow time range and inspect both the general System log and the Microsoft-Windows device channels. Event Viewer’s interface and channel availability vary by Windows release, so an absent channel or event ID is not itself proof that no connection occurred.
Free tools Windows power users keep installed
One-click scans. No signup required.
Open the relevant logs
- Press the Windows key, type Event Viewer, and open the desktop app. You can also press
Win+R, entereventvwr.msc, and press Enter. - For broad device-start and system records, open Windows Logs > System.
- For partition and removable-device diagnostics, expand Applications and Services Logs > Microsoft > Windows. Look for the Partition/Diagnostic channel and other device-related channels present on that installation.
- Look for the Microsoft-Windows Kernel-PnP configuration channel. The exact display name can differ slightly by Windows build.
Filter instead of scrolling
In a selected log, choose Filter Current Log…. Set a custom time range around the suspected connection, select the relevant event source or provider when it is listed, and enter event IDs one at a time or as a comma-separated list if the dialog accepts it. Filtering to a short interval is important on busy systems, where unrelated events can obscure the device sequence.
Which event IDs are useful?
- Microsoft-Windows-Partition/Diagnostic, event 1006: DFIR references identify this event as connection or disconnection evidence on Windows 10 and later when the channel is available and logging is enabled.
- Kernel-PnP configuration events 400 and 410: these can show device-start or configuration activity and help confirm that Windows initialized the device.
Open each candidate event and read the General and Details tabs. Note the provider, event ID, timestamp, device instance path, and any vendor, product, serial, or volume information in the event payload. An event that mentions only a generic USB hub is weaker than one containing the target device’s instance ID.
Rank #2
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
How should I interpret Event Viewer timestamps?
Use the displayed time as the time Windows wrote the event on that host. Keep the computer’s time-zone and clock settings in mind when comparing it with a phone, camera, access-control system, or another computer. A sequence of a device-start event followed by a partition or volume event can be more informative than a single generic USB notification, but the exact sequence depends on the device and Windows build.
How do I use SetupAPI.dev.log to identify a USB device?
Windows Vista and later record device-installation information in a plain-text file named SetupAPI.dev.log, normally located in %SystemRoot%INF (usually C:WindowsINF). This file is strongest evidence of installation or driver configuration. It should not be presented as a complete history of every subsequent plug-in and removal.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchOpen and search the log
- Press
Win+R, enter%SystemRoot%INF, and press Enter. If Windows opens the folder, locateSetupAPI.dev.log. - Open the file in a text editor. A large file may take time to load; use a copy if you need to preserve the original for examination.
- Search for
USBSTOR, the device instance ID, a vendor or product string, the VID/PID pair, or the device’s serial string. Searching several identifiers is safer than relying on a friendly name, which may be generic. - For each matching section, record the section-start date and time, the device instance path, the INF or driver involved, and whether the entry describes a successful installation, update, or an error.
SetupAPI section times are recorded in the host’s local time and describe installation or configuration activity. A section can be created when Windows first installs a device, when a driver is configured, or when a related device component changes. That timestamp may therefore differ from the physical moment a user inserted the device.
What does a missing SetupAPI match mean?
It means this file, in its current retained state, does not contain the identifier you searched for. The file may have been rotated, edited, cleared, or written under a different identifier. A device can also have been connected without creating a new installation section because its driver was already configured. Treat the absence as an evidence limitation, not as proof of non-use.
How do I inspect USBSTOR and related registry records?
The registry can preserve a device’s identity and selected arrival or removal bookends even after the device is unplugged. Registry inspection is more technical than Event Viewer, and changing values can damage Windows configuration, so export a key or make a forensic copy before altering anything. For read-only inspection, do not edit or delete values.
Rank #3
- What You Get - 2 pack 64GB genuine USB 2.0 flash drives, 12-month warranty and lifetime friendly customer service
- Great for All Ages and Purposes – the thumb drives are suitable for storing digital data for school, business or daily usage. Apply to data storage of music, photos, movies and other files
- Easy to Use - Plug and play USB memory stick, no need to install any software. Support Windows 7 / 8 / 10 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, compatible with USB 2.0 and 1.1 ports
- Convenient Design - 360°metal swivel cap with matt surface and ring designed zip drive can protect USB connector, avoid to leave your fingerprint and easily attach to your key chain to avoid from losing and for easy carrying
- Brand Yourself - Brand the flash drive with your company's name and provide company's overview, policies, etc. to the newly joined employees or your customers
USBSTOR: vendor, product, revision, and serial-related identity
- Press
Win+R, enterregedit, and approve the elevation prompt if Windows requests it. - Navigate to
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTOR. - Expand the vendor and product subkeys. Their names commonly encode the manufacturer, product, revision, and a serial-related identifier or an instance identifier.
- Compare those names with the device label, the instance ID found in Event Viewer, and strings found in SetupAPI.dev.log.
On supported Windows versions, forensic references describe numbered properties under a USBSTOR device key. Property 0064 can represent first installation, while 0066 and 0067 can represent last arrival and last removal. Availability and interpretation depend on the Windows version and the particular key. Treat these as bookends, not a count of every time the device was plugged in.
MountedDevices: volume and drive-letter associations
Open HKEY_LOCAL_MACHINESYSTEMMountedDevices to inspect mappings between volume identifiers and drive letters. A value such as a drive-letter mapping can help connect a USBSTOR identity to a mounted volume, but this key does not by itself provide a timestamp for every mount. Drive letters can be reassigned, and a volume may be mounted without the user opening any files.
MountPoints2: per-user context
For a user-specific association, inspect the relevant user hive at HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2. On a multi-user computer, each account has its own HKEY_CURRENT_USER view, so a check of one account does not cover other sessions. MountPoints2 can help associate a mounted volume with a user session, but it is a mapping artifact rather than a guaranteed insertion log.
How do I correlate the three evidence sources into one timeline?
Start with identifiers, then compare times. A reliable correlation uses the same device instance ID, serial-related string, VID/PID, or volume identifier across records instead of matching on a generic name such as “USB Mass Storage Device.”
- Build an identity profile. Copy the USBSTOR subkey path, vendor/product/revision text, serial-related portion, and any volume or drive-letter mapping.
- Locate installation activity. In SetupAPI.dev.log, find sections containing the same instance ID,
USBSTOR, VID/PID, or serial string. Record each relevant section-start time and the action described. - Check event evidence. Filter the System and device-related channels to a window around those times. Open event 1006 where available and Kernel-PnP 400 or 410 entries that contain the same identifier.
- Check bookends. Read the supported USBSTOR properties for first installation and last arrival or removal. Do not turn those values into a list of every historical connection.
- Resolve clock differences. Keep all times in the host’s local time, then convert them consistently if comparing with external records.
- Grade the conclusion. State whether the evidence proves installation, shows a specific event, links a volume to a user session, or only identifies a device. Record gaps and possible log rollover rather than filling them with assumptions.
How do Event Viewer, SetupAPI, and the registry differ?
The following comparison helps you select the right source for a question and prevents overclaiming what one artifact can establish.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
- GOOD VALUE PACKAGE - 1 Pack 32GB Memory Stick USB 2.0 Flash Drives with great cost performance and high quality.
- BIG CAPACITY - The available capacity: 29.10GB-29.8GB, You can save the data of movies, music, photos, designs, programs, manuals, handouts in a high speed.Good performance in digital data storing, transferring and sharing with families, friends, workmates, clients and machines.
- EASY TO USE & PLUG AND WORK - Support windows 7 / 8 / 10 / Vista / XP / 2000 / ME / NT Linux and Mac OS, Compatible with USB2.0 and below.
- TWISTTURN DESIGN & EASY CARRY - The metal clip rotates 360° round the ABS plastic body which with rubber oil skin feeling finish. The capless design can avoid lossing of cap, and providing efficient protection to the USB port.
- WARRANTY & SUPPORT - SIMMAX logo is laser printed on the USB connector surface, our products are of good quality and we promise that any problem about the product within one year since you buy.
| Source | Evidence type | Timestamp or time value | Retention after removal | Windows support | Inspection difficulty |
|---|---|---|---|---|---|
| Event Viewer: System and device-related channels | Individual connection, disconnection, start, or configuration events | Event write time on the host; precision depends on the event | Can disappear when logs are cleared or roll over; channels may be disabled | Depends on channel and build; Partition/Diagnostic event 1006 is cited for Windows 10 and later | Low to moderate; graphical filtering is available |
SetupAPI.dev.log |
Installation and driver configuration | Section-start time in the host’s local time | May remain after unplugging until the file is rotated, cleared, or otherwise changed | Windows Vista and later | Moderate; requires text searching and identifier matching |
HKLMSYSTEMCurrentControlSetEnumUSBSTOR |
Device identity and selected first/last bookends | Numbered properties such as 0064, 0066, and 0067 where supported |
Identity keys can persist after removal, subject to Windows cleanup or manual deletion | Property availability varies by Windows version | Moderate to high; read-only registry navigation is required |
HKLMSYSTEMMountedDevices |
Volume and drive-letter mapping | No guaranteed per-connection timestamp | Can remain as a mapping after a device is unplugged | Modern Windows installations | Moderate; values require careful identifier matching |
User MountPoints2 |
Per-user mounted-volume association | Not a guaranteed insertion timestamp | Depends on the user hive and Windows cleanup | Modern Windows user profiles | Moderate; each account must be considered separately |
Why might a USB connection be missing from Windows history?
A blank result is common and has several explanations that do not involve a false search.
- Log rollover: Event Viewer keeps a finite log. New events can overwrite older entries.
- Cleared or disabled channels: An administrator, maintenance tool, privacy action, or policy can clear a log or prevent a provider from writing.
- Version differences: Event IDs and registry properties are not guaranteed on every Windows release. Feature updates can affect retained artifacts.
- Already-installed drivers: SetupAPI may show the original installation but no new section for every later insertion.
- Identifier mismatch: Searching only a friendly device name can miss entries that use an instance path, serial string, or VID/PID.
- Power or hardware conditions: A device that never completed enumeration may leave partial or generic records rather than a clean storage-device entry.
- Different account or computer: MountPoints2 is per user, and evidence on another Windows installation will not appear in the current system’s logs.
Because these conditions can erase or prevent individual records, “not found” is an uncertainty statement. It is not evidence that the device was never connected.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should I do when the records disagree?
Event Viewer shows a time but SetupAPI is older
Use the event as evidence of that particular start, partition, or configuration activity and the SetupAPI entry as evidence of an earlier installation or driver action. The two timestamps answer different questions, so they do not need to match.
SetupAPI identifies the device but Event Viewer is empty
Verify that you filtered the correct time range and channels, then check whether the relevant log was enabled and whether it has rolled over. A retained installation section can outlive the event that occurred during a later connection.
USBSTOR has a device key but no obvious serial number
Use the complete subkey path and instance identifier, not just a visible product name. Compare it with the device instance path in SetupAPI and Event Viewer. Some devices expose limited or non-unique identifiers, so avoid claiming physical uniqueness unless the serial-related value supports it.
Best Value
- 【16GB Flash Drive】USB flash drives with 16GB capacity, meet your needs of daily use on work, school, home and travelling for photos, music, videos, files storage and transfer. IMEASON thumb drives can be used to store different files, easy to data backup.
- 【Metal Swivel Cap Design】USB thumb drive is metal swivel cover provides extra protection for the usb thumbdrive connector, no usb drive cap to lose; keychain design makes it easier to carry without worrying lose it.
- 【Wide Compatibility】USB drive supports Windows 7/8/10/11 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, also Supports USB 2.0 and 1.1 ports. USB Stick support TV, desktop, notebook computer, car, audio and other device. The USB Memory Stick is your great data storage and transfer companion with traveling and working.
- 【Easy to use】usb memory stick is plug and play without any software installation. Just simply plug the Flashdrive into the port of your USB-compatible devices such as computer, laptop to start data storage or transmission.
- 【What You Get】16 GB USB Flash Drive Thumb Drive, The default format of the usb storage flash drive is FAT32.
A drive letter appears in MountedDevices but no connection event exists
The mapping shows that Windows associated a volume with a drive letter at some point; it does not establish the exact insertion time or prove which user physically connected the device. Look for matching USBSTOR identity and per-user MountPoints2 context before drawing a conclusion.
What is a defensible USB-history workflow for troubleshooting or review?
Use this checklist when you need a repeatable, read-only review:
- Write down the computer name, Windows version, current local time, and the suspected connection window.
- Record the device’s visible label, serial number if available, VID/PID, and instance ID.
- Export or copy relevant registry keys and logs before making changes.
- Filter Event Viewer rather than relying on an unfiltered scroll, checking System, Partition/Diagnostic where present, and Kernel-PnP configuration records.
- Search SetupAPI.dev.log for
USBSTOR, instance ID, VID/PID, and serial-related strings. - Inspect USBSTOR, MountedDevices, and the applicable user’s MountPoints2 key.
- Keep each timestamp’s meaning attached to it: event write time, installation/configuration time, or registry bookend.
- Document missing channels, cleared logs, rollover, feature updates, and clock uncertainty.
- Report the narrowest conclusion supported by the matching identifiers and times.
This approach uses only Windows’ built-in records and is suitable for routine troubleshooting, validation of a test device, or an initial evidence review. It cannot recreate events that Windows never retained, and it should not be described as a guaranteed forensic ledger.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Frequently Asked Questions
Can Windows show every time a USB flash drive was plugged in?
No. Event logs may contain individual arrivals or removals, but they can be disabled, cleared, or overwritten. USBSTOR properties preserve supported first-install and last-arrival/last-removal bookends rather than a complete sequence.
Where can I find the serial number Windows associated with a USB device?
Start with the subkey names under HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTOR, then confirm the same instance or serial-related string in SetupAPI.dev.log. Some hardware exposes identifiers that are generic or incomplete, so a subkey is not automatically proof of a unique physical unit.
Why do SetupAPI and Event Viewer show different times for the same USB drive?
SetupAPI records installation or driver-configuration activity, while Event Viewer records a particular event such as device start or partition activity. Both use the host’s local clock, but they can refer to different stages of the device lifecycle.
Does unplugging a USB device erase its Windows history?
Unplugging does not necessarily remove every artifact: identity keys or a SetupAPI installation section may remain, and a volume mapping may persist. Retention is not guaranteed because Windows cleanup, log rollover, clearing, or feature updates can remove records.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
