Chicago
Track Your Order
0
Windows keeps a complete history of every USB device ever connected to your PC
After using a USB device on a Windows computer, you probably use the Safely Remove Hardware option to disengage the device before unplugging it. Do you assume that every trace of the device has been removed?
What you may not know is that Windows keeps a permanent registry entry for flash drives, phones, cameras, and keyboards. Even after you eject a device, traces of its presence remain. This is just one of the many types of activity a Windows computer records. I'll show you what is being recorded and the exact location on your system where it lives. By using a free tool, you can read all this information.
Windows keeps a permanent record of USB devices
Every connection is logged and stored long after the device is gone
When a new USB device is plugged into a computer, Windows installs the drivers needed for the device to run, and in the process, it creates a permanent record for that device. This becomes notable when you find out what happens next with this record: nothing. It sits there and never gets cleaned up.
Even if you unplug a device or forget it existed, the entry created from the first use remains. With time, every system builds a comprehensive archive of these devices. It outlives system reboots and updates and even remains intact through years of inactivity.
This is why Windows Device Manager feels a bit misleading. You can easily view currently plugged-in devices and some recently connected devices if you enable hidden devices. However, it hides the complete picture.
The registry, however, reveals everything, and here is where the data lives:
Windows generally uses a mix of Vendor ID (VID) and PID (Product ID), and a serial number provided by the device to index the entries. These become unique identifiers that will even tell identical devices apart as long as their serial numbers are different.
What Windows actually records about each connected device
It's more detailed than a simple connection log — and more useful than you'd expect
The level of detail that Windows captures per entry, especially for storage devices, is surprising:
- VID/PID: These are the manufacturer and specific product line, which are important elements for identifying unknown devices.
- Serial number: This is a unique hardware identifier that would be different even for identical devices.
- Friendly name: The label that Windows assigns to the device, generally consistent with what you see in File Explorer.
- Install date: when the device was first recognized and installed.
- Drive letter: The drive letter associated with this device at the time it was mounted.
However, the timestamp is sometimes missing in the registry entry. You can access this information in a separate file system location: C:\Windows\INF\setupapi.dev.log. In this log, you will find all driver installations that reflect the first time the device was plugged in.
When devices lack a manufacturer-assigned serial number, Windows creates a placeholder identifier linked to the USB port, typically beginning with an ampersand (&). These kinds of entries may be less reliable since you may get a different identifier when that same device is plugged into another port.
How to read your full USB history with USBDeview
A free portable tool turns all of this into a clean, sortable table in seconds
You can manually read these registry entries using Registry Editor (regedit), but it's not a practical option. A simpler method is to use USBDeview. This portable tool will read and list all USB devices from the registry that are connected to your computer. After downloading and extracting the .zip, double-click the executable to launch the app. It will open to a table with several columns, many of which may not be of particular interest. I like to focus on the following:
- Device Name: what the device is
- Serial Number: the hardware identifier, when available
- Last Plug/Unplug Date: the most recent connection timestamp
- Connected: whether the device is currently plugged in
- Drive letter: for storage devices, where it appeared in File Explorer
Rows that start with a green dot indicate that the device is still connected to the computer. You can sort by a specific column by navigating to View -> Sort by and selecting the column name.
Double-click a device row to open its Properties window and view all fields at once. This allows you to view all its column entries in a single window without the need to scroll.
The scenarios where knowing your USB history actually changes what you do
There are three scenarios where I find this USB data useful. The first is when a USB device is not functioning properly. It could be one that randomly disconnects, doesn't mount, or constantly triggers an error. These cases often make you conclude it's a hardware problem. A simple troubleshooting step is to check USBDeview for entries for the same device on different ports. Old entries can conflict; removing them may resolve issues.
If a laptop is returned to you, you can use USBDeview to view all storage devices connected to it. This doesn't show the accessed files, but you can see if an unknown storage device was attached and when it was plugged in. This knowledge may help you know what follow-ups you need to do.
Lastly, in cases when a drive dies, data recovery services typically require the drive's model or serial number up front. If you can't access these again, looking through the registry entries provides this vital information. Stored USB drive entries are not something you use daily, but when a situation warrants this data, you will be glad that Windows has this feature.
