History of External Drives Previously Connected?

Luke_Smith_2

Hi,

Does anyone know if there is historical information stored in a computer that logs the external drives that have been previously connected?

For example, I have an external hard drive that I connect via USB to my laptop. When connected the drive name 'Transcend' is visible in My Computer. Is there any information logged to state that the 'Transcend' drive was connected on xx date?

I am sure that this seems like a very strange question. The reason I am interested to know this is because my personal hard drive containing all the information I have accumulated over the years (resources, pictures,receipts etc etc) was stolen from me at work. I am pretty sure I know who took the drive and I am also sure that the person in question would have accessed the drive from his work laptop.

Which brings me to another question! Is there a file that logs the 'Recently Viewed Documents'? This may be another way of proving that the person in question had accessed my drive after it had "gone msissing". I know that there is the tab in the Start menu but I was wondering where actual log file is?

Any other bright ideas related to the issue above would be greatly appreciated!

Many thanks in advance,

Luke

dixiebb

some info might be stored in the Event Viewer logs ; perhaps the registry too -- but I'd be reluctant to tinker with the latter.

closed

It's all stored in the registry, this tool can pick it up

http://www.nirsoft.net/utils/usb_devices_view.html

You could use regscanner to search for e: or whatever the external drive would be named, or look for mru's in the users profile

http://support.microsoft.com/kb/826208

scheming_gypsy

Luke_Smith wrote: »

Which brings me to another question! Is there a file that logs the 'Recently Viewed Documents'? This may be another way of proving that the person in question had accessed my drive after it had "gone msissing". I know that there is the tab in the Start menu but I was wondering where actual log file is?

it's a folder in their profile called 'recent'

if you have admin rights to the laptop you can check it on the sly as well from the comfort of your own desk.

Luke_Smith_2

Thankyou all VERY much for your replies. I will check with our technical support and see which they are happy to undertake.

I really appreciate you each taking the time to help me.

Kind regards,

Luke