How to find out when a USB disk was removed in Windows 11

It is certainly sometimes necessary to keep track of when a USB flash drive is plugged into your computer and when it is removed.

But Windows itself does not offer this option. However, you can modify some settings in the Event Viewer to start tracking it. Below we explain how to do it, so continue reading:

How to find out when a USB disk was removed in Windows 11

Method 1: Leveraging Windows Event Viewer (Requires Enabling Logging)

Administrator Privileges: Ensure you possess administrator credentials for both methods.

Accessing Event Viewer: Utilize the keyboard shortcut Windows + X and select Event Viewer.

Navigating to Specific Logs: Locate the following path within the Event Viewer hierarchy:

Application and Services Logs > Microsoft > Windows > DriverFrameworks-UserMode

Enabling Operational Log: Right-click on the Operational log and select Properties. Check the box labeled Enable logging, followed by clicking Apply and OK. This initiates Windows tracking of USB device connections and removals.

Important Note: Enabling logging creates a continuous log. Consider disabling it after troubleshooting to optimize storage usage.

Reviewing USB Events: Once a USB disk is connected or removed, revisit the path mentioned in step 3. You'll encounter various logs with specific Event IDs:

2003, 2004, 2006, 2010: Correspond to connection events.

2100, 2101, 2105, 2106: Indicate disconnection events.

Event Details: Double-click on a relevant Event ID to determine the specific device connected/removed and the corresponding date/time stamp.

Method 2: Utilizing USBDeview (Third-Party Tool)

Download and Extract: Download USBDeview from a trusted source like

https://www.nirsoft.net/utils/usb_devices_view.html and extract the downloaded file.

Run USBDeview: Double-click on USBDeview.exe to launch the application.

Review Connected/Previously Connected Devices: USBDeview presents a comprehensive list of all currently connected and previously used USB devices on your system.

Sorting and Filtering (Optional): To expedite navigation, navigate to View > Sort by and choose a sorting criterion like "Storage" to prioritize storage devices.

Event Details: Double-click on a specific USB device entry. Look for Registry Time 1 and Registry Time 2.

Registry Time 1: Indicates the initial connection time of the device.

Registry Time 2: Shows the last recorded time (current date/time if the device is still connected).

Choosing the Appropriate Method:

Windows Event Viewer: Optimal if you only require tracking USB disk removals from this point forward. Enabling logging establishes an ongoing record.

USBDeview: Provides a historical record of all USB devices ever connected, including removal times. This is particularly valuable for forensic analysis or identifying unfamiliar devices.

Additional Considerations:

Windows Event Viewer won't display previously connected devices unless logging was enabled beforehand.

USBDeview is a free, portable tool that doesn't require installation.

We hope that by following these methods, you can be equipped to effectively determine the removal time of USB drives on a Windows 11 system, improving system security and monitoring practices.