how to check the last file transfer using USB on my windows. how to check the date of the files been used on my Windows from USB flash drive?

Gursimar Kaur 0 Reputation points
2026-07-13T21:57:51.6166667+00:00

I need to know if we can check on our windows system the last track of USB flashdrive been used on the device and can we check what files were used?

Windows for home | Previous Windows versions | Files, folders, and storage
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Thomas4-N 21,665 Reputation points Microsoft External Staff Moderator
    2026-07-14T09:17:24.94+00:00

    Hello Gursimar Kaur,

    The other advisor's PowerShell approach is solid for pulling file timestamps (LastWriteTime, LastAccessTime, CreationTime) off a drive once you point -Path at the USB's drive letter.

    Worth splitting your question into two parts though, since they're tracked pretty differently:

    Which USB drives were connected, and when — this part is well covered:

    • Easiest is NirSoft USBDeview (free) — lists every USB storage device with first/last connect timestamps.
    • Or Event Viewer > Windows Logs > System, filter for source USBSTOR / partition events.
    • The registry also keeps a record under HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR if you want to dig manually.

    Which files were actually opened from the USB — this is the weaker half. Windows doesn't keep a clean native log of "files opened from a specific drive." You can sometimes piece it together from leftover traces:

    • File timestamps on the drive itself (which is what the PowerShell command above shows)
    • Recent Items / jump lists
    • Leftover .lnk shortcut files

    If you need to, feel free to share what you're ultimately trying to figure out (device usage vs. specific file access).

    If the answer is helpful, please click "Yes". If you have extra questions about this answer, please click "Comment". 

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

    Was this answer helpful?

  2. MotoX80 37,861 Reputation points
    2026-07-14T00:43:25.34+00:00

    One option is to use Powershell and report on the LastWriteTime, LastAccessTime and CreationTime properties. 

    Get-ChildItem -File | Sort-Object -Property LastWriteTime -Descending | Format-Table -Property Name, LastWriteTime, LastAccessTime, CreationTime

    It would look like this. I analyzed the Temp directory. You could also use the -Path switch to specify the directory.

    User's image

    Another command would report on the 10 most recently updated files in the folder and all subdirectories. 

    Get-ChildItem -File -Recurse | Sort-Object -Property LastWriteTime -Descending | Format-Table -Property FullName, LastWriteTime, LastAccessTime, CreationTime | Select-Object -First 10

    User's image

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.