Because you do not know the application that is causing the hang or crash, you should use another method instead. Enable WER to collect a memory dump on any crash event: Info on registry key involved Example reg file: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps] "DumpFolder"=hex(2):43,00,3a,00,5c,00,6c,00,6f,00,63,00,61,00,6c,00,64,00,75,\ 00,6d,00,70,00,73,00,00,00 "DumpType"=dword:00000002 This should generate a full crash dump next BSOD you get. Of course if you get a BSOD at any other time, it will still do it. You should back up your existing keys in that section so that you can revert back to the default setting for this after you capture your USB insert crash.