[sedd_18]

I live in a sort of dorm type environment and left my computer on when I went to the bathroom, when I came back I had this balloon warning message over the USB device thing in the system tray saying a device had been removed. I checked just about everywhere I could think of for log files that might keep track of this type of thing and searched the forum here with now luck. Any ideas on how I can find out if someone was tryn to take infor off my computer? Thanks for your help.

[LLXX]

Look in the device manager?

[sedd_18]

I looked thru device manager and it doesn't show a history of what devices have been hooked up. I also looked in the even viewer but all it shows is errors. I was looking for something that would tell me if something was plugged in or if my computer is just freaking out. Thanks again for your help and suggestions.

[nitroshift]

set the device manager to show hidden devices.

[jaclaz]

You can scan the registry.

All devices connected once should have an entry.

They should be in:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB
but check also in
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USB
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB

Mass storage devices will have additional entries in
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

jaclaz

[T D]

And open device manager, click View>Show devices by connection. On mine, most of my usb stuff is in usb ports plugged in 2 PCI ports, so my usb devs are listed under "ACPI Multiprocessor System">"PCI Bus">"Intel <some random numbers>FB USB to PCI>"my usb devices".

[Mordac85]

But if the device is no longer connected, will there be anything listed in either device manager or the registry?

[IcemanND]

yes some stuff is left behind, like with usb storage devices, that's how it knows what drive letter to assign the next time you install it.

[sedd_18]

Thanks guys, I'm going to check out the registry entires in a little bit. I appreciate the help.

[pmshah]

In this kind of situation you should religiously delete the hidden devices once you are through using them. The next time anyone plugs in a usb device it will leave a trace but won't prevent data theft. The best way would be to disable the usb support in bios. Those onboard usb connectors on the PCs are the number culprits for data theft in corporate environment.

[IcemanND]

just password protect all your accounts and turn on the screen saver lock, and lock your machine when you walk away. Then no one has a chance to get anything from your machine.