sedd_18 Posted July 4, 2006 Share Posted July 4, 2006 I live in a sort of dorm type environment and left my computer on when I went to the bathroom, when I came back I had this balloon warning message over the USB device thing in the system tray saying a device had been removed. I checked just about everywhere I could think of for log files that might keep track of this type of thing and searched the forum here with now luck. Any ideas on how I can find out if someone was tryn to take infor off my computer? Thanks for your help. Link to comment Share on other sites More sharing options...
LLXX Posted July 4, 2006 Share Posted July 4, 2006 Look in the device manager? Link to comment Share on other sites More sharing options...
sedd_18 Posted July 4, 2006 Author Share Posted July 4, 2006 I looked thru device manager and it doesn't show a history of what devices have been hooked up. I also looked in the even viewer but all it shows is errors. I was looking for something that would tell me if something was plugged in or if my computer is just freaking out. Thanks again for your help and suggestions. Link to comment Share on other sites More sharing options...
nitroshift Posted July 4, 2006 Share Posted July 4, 2006 set the device manager to show hidden devices. Link to comment Share on other sites More sharing options...
jaclaz Posted July 4, 2006 Share Posted July 4, 2006 You can scan the registry.All devices connected once should have an entry.They should be in:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBbut check also inHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USBHKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USBMass storage devices will have additional entries inHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTORjaclaz Link to comment Share on other sites More sharing options...
T D Posted July 4, 2006 Share Posted July 4, 2006 And open device manager, click View>Show devices by connection. On mine, most of my usb stuff is in usb ports plugged in 2 PCI ports, so my usb devs are listed under "ACPI Multiprocessor System">"PCI Bus">"Intel <some random numbers>FB USB to PCI>"my usb devices". Link to comment Share on other sites More sharing options...
Mordac85 Posted July 4, 2006 Share Posted July 4, 2006 But if the device is no longer connected, will there be anything listed in either device manager or the registry? Link to comment Share on other sites More sharing options...
IcemanND Posted July 5, 2006 Share Posted July 5, 2006 yes some stuff is left behind, like with usb storage devices, that's how it knows what drive letter to assign the next time you install it. Link to comment Share on other sites More sharing options...
sedd_18 Posted July 5, 2006 Author Share Posted July 5, 2006 Thanks guys, I'm going to check out the registry entires in a little bit. I appreciate the help. Link to comment Share on other sites More sharing options...
pmshah Posted July 6, 2006 Share Posted July 6, 2006 In this kind of situation you should religiously delete the hidden devices once you are through using them. The next time anyone plugs in a usb device it will leave a trace but won't prevent data theft. The best way would be to disable the usb support in bios. Those onboard usb connectors on the PCs are the number culprits for data theft in corporate environment. Link to comment Share on other sites More sharing options...
IcemanND Posted July 6, 2006 Share Posted July 6, 2006 just password protect all your accounts and turn on the screen saver lock, and lock your machine when you walk away. Then no one has a chance to get anything from your machine. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now