# External drive

**URL:** <https://boards.straightdope.com/t/external-drive/940212>\
**Category:** Factual Questions\
**Created:** [April 17, 2021, 4:19pm UTC](https://boards.straightdope.com/t/external-drive/940212 "2021-04-17T16:19:55Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![bob\_2](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bob_2/32/3341_2.png) [@bob\_2](https://boards.straightdope.com/u/bob_2)\
**Post date:** [April 17, 2021, 4:19pm UTC](https://boards.straightdope.com/t/external-drive/940212/1 "2021-04-17T16:19:55Z")

</div>

How can you tell if someone plugged an external drive to a PC on W10?

---

<div class="post-metadata">

**Author:** ![MindsEye\_Watering](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mindseye_watering/32/3619_2.png) [@MindsEye\_Watering](https://boards.straightdope.com/u/MindsEye_Watering)\
**Post date:** [April 17, 2021, 4:33pm UTC](https://boards.straightdope.com/t/external-drive/940212/2 "2021-04-17T16:33:17Z")

</div>

A quick look at “This PC” on the start Menu will show all the connected drives.

---

<div class="post-metadata">

**Author:** ![bob\_2](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bob_2/32/3341_2.png) [@bob\_2](https://boards.straightdope.com/u/bob_2)\
**Post date:** [April 17, 2021, 4:35pm UTC](https://boards.straightdope.com/t/external-drive/940212/3 "2021-04-17T16:35:17Z")

</div>

But not if it was only temporary. Someone plugs a thumb drive in, downloads a file and takes it away…

---

<div class="post-metadata">

**Author:** ![Jeff\_Lichtman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jeff_lichtman/32/1531_2.png) [@Jeff\_Lichtman](https://boards.straightdope.com/u/Jeff_Lichtman)\
**Post date:** [April 17, 2021, 4:48pm UTC](https://boards.straightdope.com/t/external-drive/940212/4 "2021-04-17T16:48:24Z")

</div>

Do you mean how can you tell whether an external drive is currently plugged in? To do that, you can open File Explorer and go to This PC. Under Devices and Drives it will show all the drives that are connected to the computer. Alternatively, you can open the Devices and Printers control panel, which will show all devices, both internal and external.

There’s an app called USBDeview that tells what USB devices have ever been connected to a PC. I’ve never used it or even installed it. You can get it here:

> **[View any installed/connected USB device on your system](http://www.nirsoft.net/utils/usb_devices_view.html)**
>
> USBDeview is a software that lists all USB devices that connected to your computer, and allows you disable, enable or uninstall them.

---

<div class="post-metadata">

**Author:** ![DCnDC](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dcndc/32/2842_2.png) [@DCnDC](https://boards.straightdope.com/u/DCnDC)\
**Post date:** [April 17, 2021, 4:49pm UTC](https://boards.straightdope.com/t/external-drive/940212/5 "2021-04-17T16:49:51Z")

</div>

If you have the Operational Log turned on in the Event Viewer app, you can look there, but it’s turned off by default.

If not, this is how you turn it on:  
[open Event Viewer] \> Application and Services Logs \> Microsoft \> Windows \> DriverFrameworks-UserMode \> Operational log

Right click on “Operational log” and open “Properties” then check the “Enable Logging” box.

This won’t help you right now of course, but it will in the future.

---

<div class="post-metadata">

**Author:** ![DesertDog](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/desertdog/32/11503_2.png) [@DesertDog](https://boards.straightdope.com/u/DesertDog)\
**Post date:** [April 17, 2021, 5:02pm UTC](https://boards.straightdope.com/t/external-drive/940212/6 "2021-04-17T17:02:31Z")

</div>

Cool! Would it record events like a worm doing something nefarious or just the physical stuff like drive access?

---

<div class="post-metadata">

**Author:** ![Darren\_Garrison](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/darren_garrison/32/92_2.png) [@Darren\_Garrison](https://boards.straightdope.com/u/Darren_Garrison)\
**Post date:** [April 17, 2021, 5:08pm UTC](https://boards.straightdope.com/t/external-drive/940212/7 "2021-04-17T17:08:45Z")

</div>

Worms can’t plug in USB drives–they have no hands.

---

<div class="post-metadata">

**Author:** ![pjd](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pjd/32/3009_2.png) [@pjd](https://boards.straightdope.com/u/pjd)\
**Post date:** [April 17, 2021, 5:46pm UTC](https://boards.straightdope.com/t/external-drive/940212/8 "2021-04-17T17:46:07Z")

</div>

Yes. they do have hands  
[cite](https://www.aliexpress.com/i/32863247293.html)

---

<div class="post-metadata">

**Author:** ![Mijin](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mijin/32/9369_2.png) [@Mijin](https://boards.straightdope.com/u/Mijin)\
**Post date:** [April 18, 2021, 3:11am UTC](https://boards.straightdope.com/t/external-drive/940212/9 "2021-04-18T03:11:14Z")

</div>

When you’re listing devices in device manager, you can choose View | Show Hidden Devices.

What you’ll probably get is a very long list of generically titled “USB drive” or whatever. But by one by one plugging every drive that you personally use, you can work out whether another drive has ever been used… Which could be useful if the laptop is new or the number of drives you’ve ever plugged is small and known.

---

<div class="post-metadata">

**Author:** ![DCnDC](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dcndc/32/2842_2.png) [@DCnDC](https://boards.straightdope.com/u/DCnDC)\
**Post date:** [April 20, 2021, 5:35pm UTC](https://boards.straightdope.com/t/external-drive/940212/10 "2021-04-20T17:35:12Z")

</div>

> [@DesertDog](#):
>
> Cool! Would it record events like a worm doing something nefarious or just the physical stuff like drive access?

Possibly, but you’d have to know exactly what to look for _and_ where. If you click around the Event Viewer even for a minute you’ll quickly notice it’s a humongous, unwieldy amount of info that is largely undecipherable to almost everyone. It’s highly unlikely you will just happen upon malware doing nefarious things to your machine, and even if you did, it’s still probably unlikely you would recognize it as that. I’m no expert, but I certainly wouldn’t, I can tell you that much.
