Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know this sounds kind of ridiculous, but someone stole my mouse from my cubicle.. I came to work in the morning and was about to give my mouse a little shove to wake up the monitor, but it wasn't there!

I'm trying to figure out when this happened. I'm running Windows 7 and it's a USB mouse. I checked the event logs, but there doesn't seem to be any logs that might tell me what I'm looking for.

Is there any place where USB unplug events are logged?

share|improve this question

migrated from Mar 29 '11 at 14:48

This question came from our site for system and network administrators.

My event log is called a security camera. – Bart Silverstrim Mar 29 '11 at 14:34
I generally find missing mice in the dryer. – GregD Mar 29 '11 at 15:12
Set a trap, buy a hidden camera and a nicer mouse to temp the thief again. – Moab Mar 29 '11 at 20:46
I love this question, would love to see it answered... – studiohack Mar 30 '11 at 21:10
was the culprit ever caught? – Andrew Heath Nov 9 '11 at 6:37
up vote 5 down vote accepted

There isn't a log of them unfortunately - those events are lost forever. I've always wanted a dmesg equivalent on Windows.

With Windows XP and earlier, you can use winmsd to produce a system configuration output, but in later versions it's been replaced with msinfo32 (GUI application that I'm not so sure about parsing the output of).

Both of those only give you point-in-time information though, so for mouse-theft detective work you'd need to be regularly logging the output of winmsd to a file. I must admit I'd personally go with the webcam suggestion in the future.

share|improve this answer
But is it "possible" for a Windows program to do it? Or is the functionality just not available in Windows (so programs do not have the capability to do so)? – Pacerier Jul 5 '12 at 13:11
Actually, there is a log file for this. It's called Microsoft-Windows-DriverFrameworks-UserMode-Operational.evtx but it's disabled by default on Win10. – StackzOfZtuff Jan 27 at 11:29

It might be too late now, but there ARE a couple pieces of software that will do exactly that. The easiest one to use being USBLogView

Other options, not so friendly, are the Windows USB Storage Parser or Microsoft's USBView (UVCView on Win7), that ships with the Windows Driver Kit (WDK).

If you really want to get your hands dirty, open RegEdit and look for the following entries:

Description: List of Installed USB devices, both connected and unconnected Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB Why you care: It can be useful to know what USB devices have be connected to a box, and even the vendor and serial number of the device in some cases. Think someone copied the data to a thumbdrive? This may help you trace down what thumbdrive. Think how useful it can be to help tie something a user physical possesses to a box.

Description: List of installed USB storage devices Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR Why you care: Much like the installed USB devices entry, but just for USB storage. Think someone copied the data to a thumbdrive? This may help you trace down what thumbdrive. CleanAfterMe scrubs HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB but not USBSTOR when I tested last.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .