How can you tell if someone plugged an external drive to a PC on W10?
A quick look at “This PC” on the start Menu will show all the connected drives.
But not if it was only temporary. Someone plugs a thumb drive in, downloads a file and takes it away…
Do you mean how can you tell whether an external drive is currently plugged in? To do that, you can open File Explorer and go to This PC. Under Devices and Drives it will show all the drives that are connected to the computer. Alternatively, you can open the Devices and Printers control panel, which will show all devices, both internal and external.
There’s an app called USBDeview that tells what USB devices have ever been connected to a PC. I’ve never used it or even installed it. You can get it here:
If you have the Operational Log turned on in the Event Viewer app, you can look there, but it’s turned off by default.
If not, this is how you turn it on:
[open Event Viewer] > Application and Services Logs > Microsoft > Windows > DriverFrameworks-UserMode > Operational log
Right click on “Operational log” and open “Properties” then check the “Enable Logging” box.
This won’t help you right now of course, but it will in the future.
Cool! Would it record events like a worm doing something nefarious or just the physical stuff like drive access?
Worms can’t plug in USB drives–they have no hands.
Yes. they do have hands
cite
When you’re listing devices in device manager, you can choose View | Show Hidden Devices.
What you’ll probably get is a very long list of generically titled “USB drive” or whatever. But by one by one plugging every drive that you personally use, you can work out whether another drive has ever been used… Which could be useful if the laptop is new or the number of drives you’ve ever plugged is small and known.
Possibly, but you’d have to know exactly what to look for and where. If you click around the Event Viewer even for a minute you’ll quickly notice it’s a humongous, unwieldy amount of info that is largely undecipherable to almost everyone. It’s highly unlikely you will just happen upon malware doing nefarious things to your machine, and even if you did, it’s still probably unlikely you would recognize it as that. I’m no expert, but I certainly wouldn’t, I can tell you that much.