AntiMalware Status

How to find out what USB device was plugged into your system

Here are 2 commands that you can use to see what USB device has been used on your system – whatever reasons you may have for this — it is good to know:

Option # 1:

Get-ChildItem HKLM:\SYSTEM\ControlSet001\Enum\USBSTOR | Select-Object PSChildname

PSChildName
———–
CdRom&Ven_HL-DT-ST&Prod_DVDRAM_GP08NU20&Rev_1.01
Disk&Ven_&Prod_&Rev_
Disk&Ven_&Prod_USB_DISK_2.0&Rev_PMAP
Disk&Ven_ADATA&Prod_USB_Flash_Drive&Rev_1.00
Disk&Ven_General&Prod_USB_Flash_Disk&Rev_1100
Disk&Ven_JetFlash&Prod_Transcend_16GB&Rev_1100
Disk&Ven_JetFlash&Prod_Transcend_4GB&Rev_1100
Disk&Ven_JetFlash&Prod_Transcend_64GB&Rev_1100
Disk&Ven_KINGSTON&Prod_DataTraveler_3.0&Rev_1.01
Disk&Ven_Kingston&Prod_DataTraveler_3.0&Rev_PMAP
Disk&Ven_SanDisk&Prod_Cruzer_Facet&Rev_1.26
Disk&Ven_SanDisk&Prod_Wireless_Drive&Rev_A02S
Disk&Ven_WD&Prod_My_Passport_0730&Rev_1015
Other&Ven_WD&Prod_SES_Device&Rev_1015

Option # 2:

 Get-ItemProperty -Path ’HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\*’ | Select FriendlyName

FriendlyName
————
HL-DT-ST DVDRAM GP08NU20 USB Device
USB Device
USB DISK 2.0 USB Device
ADATA USB Flash Drive USB Device
General USB Flash Disk USB Device
JetFlash Transcend 16GB USB Device
JetFlash Transcend 4GB USB Device
JetFlash Transcend 64GB USB Device
KINGSTON DataTraveler 3.0 USB Device
Kingston DataTraveler 3.0 USB Device
Kingston DataTraveler 3.0 USB Device
SanDisk Cruzer Facet USB Device
SanDisk Wireless Drive USB Device
WD My Passport 0730 USB Device

As you can see the Option # 2 is little bit more readable and cleaner but both are same. Another way to see the devices and history or clear the history – use FREE utility from Nirsoft – USBDVIEW – Heads up — some tools from this website are triggering your antivirus :-). USBDeview also allows you to uninstall USB devices that you previously used, disconnect USB devices that are currently connected to your computer, as well as to disable and enable USB devices.

Have fun!

Leave a Reply