How to check the USB disk removal time through the system log

How to check the USB disk removal time through the system log: First open the control panel and find the computer management, add the environment variable [devmgr_shownonpresent_devices] to the system, the value is 1; then open the computer management and change the removable Storage-related deletions; finally check the USB disk removal time.

1. Open Control Panel->Administrative Tools->Computer Management,

2. Add environment variables to the systemdevmgr_shownonpresent_devices, value is 1.

3. Run Device Manager and open View Hidden Devices. Expand the disk drive and storage volume, and kill those related to the USB flash drive.

4. Open Computer Management and delete related to removable storage.

5. Delete the system environment variables added in 1.

6. So far, it may not be possible to delete all the USB usage records in the registry. In HKEY_LOCAL_MACHINE\

SYSTEM\ControlSet002\Enum There may still be usage records in \USBSTOR, then open the powerful regedt3.

7. Tool, find the item, modify the permissions, and then delete the subitem. in addition. Some of the HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB related to the USB Storage Mass device must also be deleted.

8. Clear the U disk usage record in the registry,

1. Press Start-->Run, enter the command in the input box: regedit,

2. Delete the USBSTOR subkeys of the following directories in the registry.

（1）HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USBSTOR
（2）HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USBSTOR
（3）HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\USBSTOR
（4）HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

9. After deleting the above USBSTOR sub-item, general confidentiality checking software will no longer be able to check.

10. If you need to completely clear the USB usage record, after completing the above operation, you can follow the following operation process:

1. Delete the following USB subkeys except ROOT_HUB and ROOT_HUB20# All records except ##.

（1）HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USB
（2）HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USB
（3）HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\USB
（4）HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB

11. The permission operation is consistent with the above operation.

2. Delete some sub-items containing the word usb such as a5d..., 53f... under

DeviceClasses.

（1）HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{a5dcbf10-6530-11d2-901f-00c04fb951ed}
（2）HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\DeviceClasses\{a5dcbf10-6530-11d2-901f-00c04fb951ed}
（3）HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\DeviceClasses\{a5dcbf10-6530-11d2-901f-00c04fb951ed}
（4）HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\##?#USBSTOR#Disk&Ven_Alcor&Prod_Flash_Disk&Rev_8.07#2624BFBB&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Other operations are the same as the previous step.

The above is the detailed content of How to check the USB disk removal time through the system log. For more information, please follow other related articles on the PHP Chinese website!