Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I think I have just lost a USB stick. Is there a way to view all the file transfers made from a PC to the external drive, so I can double check everything that was on the drive? Very unlikely, but there are important files that could have been on it.

Does the event viewer log these type of events?

Any help would be appreciated, think I'll stick to cloud storage from now on...

share|improve this question

marked as duplicate by Nifle, gronostaj, davidgo, Kevin Panko, Mokubai Jan 4 '15 at 9:47

This question was marked as an exact duplicate of an existing question.

With respect to your comment on cloud storage: from a security point of view, if you encrypted your flash drive it would be a lot more secure than anything sent into "the cloud." – Moses May 15 '13 at 20:29
Its funny, because that also popped into my head as soon as i realised what happened.. But i am 99.99% sure everthiny on it was pretty much useless would be nice to check for peace of mind though. I have definitely learnt my lesson though! Novice mistake! – Joe May 15 '13 at 20:31

Does the event viewer log these type of events?


If the Event Log logged every file transfer in the system, it'd be full pretty quickly. :)

Can it be set up? Yes, but not without 3rd party software (or some fancy programming/scripting of your own) that monitors for those (specific) file actions/events.

Related SU question: Can a file transfer to a USB pen drive be tracked in windows 7?

share|improve this answer
Thanks for the feedback, if its one file in particular is there a way to view any changes/events of that file? Sorry for the repitition. – Joe May 15 '13 at 20:52
On the properties of the file mentioned, the modified and accessed dates of the file are the same as the date it was created, does this mean anything in relation to trasnfer? Thanks – Joe May 15 '13 at 20:54
Doesn't look like it. I just tried (from SU question How can I display the time stamp of a file with seconds, from the command line?)) Get-ChildItem akf.txt -Force | Select-Object FullName, CreationTime, LastAccessTime, LastWriteTime That shows all of that file's time. Then I copied the file as akf2 and ran that command on akf2.txt. Looking at the source file,the access time didn't change to the creation and access time of the copied file.Another thing I looked at is the archive bit(which can b turned off from a copy) but that happens with cmd's xcopy /m not with windows gui copy or cmd copy – barlop May 15 '13 at 21:07

Not the answer you're looking for? Browse other questions tagged .