19

I know this sounds kind of ridiculous, but someone stole my mouse from my cubicle.. I came to work in the morning and was about to give my mouse a little shove to wake up the monitor, but it wasn't there!

I'm trying to figure out when this happened. I'm running Windows 7 and it's a USB mouse. I checked the event logs, but there doesn't seem to be any logs that might tell me what I'm looking for.

Is there any place where USB unplug events are logged?

migrated from serverfault.com Mar 29 '11 at 14:48

This question came from our site for system and network administrators.

  • 7
    My event log is called a security camera. – Bart Silverstrim Mar 29 '11 at 14:34
  • 3
    I generally find missing mice in the dryer. – GregD Mar 29 '11 at 15:12
  • 2
    Set a trap, buy a hidden camera and a nicer mouse to temp the thief again. – Moab Mar 29 '11 at 20:46
  • 2
    I love this question, would love to see it answered... – studiohack Mar 30 '11 at 21:10
  • 3
    was the culprit ever caught? – Drew Nov 9 '11 at 6:37
5

There isn't a log of them unfortunately - those events are lost forever. I've always wanted a dmesg equivalent on Windows.

With Windows XP and earlier, you can use winmsd to produce a system configuration output, but in later versions it's been replaced with msinfo32 (GUI application that I'm not so sure about parsing the output of).

Both of those only give you point-in-time information though, so for mouse-theft detective work you'd need to be regularly logging the output of winmsd to a file. I must admit I'd personally go with the webcam suggestion in the future.

7

It might be too late now, but there ARE a couple pieces of software that will do exactly that. The easiest one to use being USBLogView

Other options, not so friendly, are the Windows USB Storage Parser or Microsoft's USBView (UVCView on Win7), that ships with the Windows Driver Kit (WDK).

If you really want to get your hands dirty, open RegEdit and look for the following entries:

Description: List of Installed USB devices, both connected and unconnected Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB Why you care: It can be useful to know what USB devices have be connected to a box, and even the vendor and serial number of the device in some cases. Think someone copied the data to a thumbdrive? This may help you trace down what thumbdrive. Think how useful it can be to help tie something a user physical possesses to a box.

Description: List of installed USB storage devices Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR Why you care: Much like the installed USB devices entry, but just for USB storage. Think someone copied the data to a thumbdrive? This may help you trace down what thumbdrive. CleanAfterMe scrubs HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB but not USBSTOR when I tested last.

  • 1
    Monitoring those keys with Procmon.exe from SysInternals did exactly what I needed. – Doug Wilson May 19 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.