Subscribe

Get the Network Administrators tool pack

Subscribe to our newsletter and get 11 free network administrator tools, plus a 30 page user guide so you can get the most out of them.

Click Here to get your free tools



Recent Posts

Search

Archives

View USB Flash Drive History

Post image for View USB Flash Drive History

by Steve Wiseman on July 7, 2011 · 10 comments

in Tips,Tools


.

We have been working hard on the next version of Network Administrator.

As we build out our new libraries for it, we are releasing free tools based on our internal framework.

It allows us to field test aspects of the execution engine, and at the same time you get a freebie.

Right now, the plugin system allows us to disable usb flash drives, or change power settings, etc… but it is limited in the fact it can’t report back detailed information.

The latest tool that we are releasing, allows you to get a history of all USB flash drives that have ever been mounted on a computer.

You just pick a computer (Use localhost for the current computer), hit start, and it shows you a complete report:

It includes the device ID, a date and time stamp of the last time it was used, and it will even let you know if it is currently mounted.

You can download it from our downloads page:

http://www.intelliadmin.com/index.php/downloads/

Oh, and by the way. This type of functionality will be included in the next version of Network Administrator. If you purchase today, it will be a free upgrade.

One more thing…Subscribe to my newsletter and get 11 free network administrator tools, plus a 30 page user guide so you can get the most out of them. Click Here to get your free tools

Related Articles:

{ 10 comments… read them below or add one }

1 Josh Willis July 7, 2011 at 3:55 pm

Timely post as usual steve. Just last week we had a need to see if, and when a flash drive was used on one of our servers. There are a few free command line tools out there that I found, but I like your easy to use GUI interface. Plus the fact that none of the ones I found can do it remotely.

BTW, Just purchased a copy of Network Administrator. Great tool

2 Steve Wiseman July 7, 2011 at 4:51 pm

Thanks for the kind words, and the order :)

3 Jen Minsk July 7, 2011 at 4:52 pm

Will this show me a drives that are not plugged in, but were plugged in at one time before?

4 Steve Wiseman July 7, 2011 at 4:53 pm

Hello Jen,

Yes. It will show you a list of all the USB drives that were connected to the machine….unless of course someone went into the registry and deleted the history.

5 Angus S-F July 8, 2011 at 1:31 am

Unfortunately it doesn’t show you a history of their plugging and unplugging, which can be Very Useful Info when tracking down which of your many USB devices is infected.

USBlogger will do that, but it’s abandonware from Uwe Sieber, with whom I have exchanged emails. He says it’s free to use even in commercial environments. It has to be installed as a Windows Service, and it’s hard-coded to use certain file paths unfortunately.

It would be a Good Thing if Network Administrator were to add this capability.

Grab a copy here:
http://www.uwe-sieber.de/files/usblogger.zip

6 Angus S-F July 8, 2011 at 1:32 am

Similar tool, freeware, is available from NirSoft.net:

View any installed/connected USB device on your system
http://nirsoft.net/utils/usb_devices_view.html

7 David Chang July 8, 2011 at 11:09 am

Yea Angus, have used that one before too. I like this intelliadmin one since every option is on the main screen. I am looking for quick and intelli has got it nailed.

8 Steve Wiseman July 8, 2011 at 11:13 am

Thanks for the links Angus…I will have to check them out. The trouble with logging like that with Network Administrator is that it would have to run as a service on the machine….just like his…this is because you need to sit there and watch for USB device changes. This is somewhat similar to what we do with USB Disabler Pro:

http://www.intelliadmin.com/index.php/usb-disabler-pro/

We are working on a new version of that too…so these are all good ideas :)

9 Angus S-F November 16, 2011 at 11:42 pm

Too bad Event Viewer doesn’t log USB insertions and removals in an EVT file.

10 Dee Kay June 18, 2012 at 12:35 pm

I personally would like to see a tool which can:
1. log Date and Time| UID | Hostname| Data Usage in MBs| Where was data copied from?
2. Should have capability to run against multiple machines.
3. HTML, CSV friendly reporting.

My use case is to keep tabs on how USB devices are used in the firm and find out whether there is a data leak or virus, malware, grayware being introduced to our environment.

Hopefully these reqs are useful in your future update/design of the tool.

Best,
DK

Leave a Comment

Ask 27.com - Category Links - Windows Forum - Exchange Forum