Which USB drives were plugged into this PC

1. The log

Windows keeps it at C:\Windows\INF\setupapi.dev.log. Copy it off the machine and open it here; nothing is uploaded and the file on disk is never written to.

No log open yet.

2. What the log covers

3. The devices

Every device install the log records, oldest first. A row is written when Windows installed the device, which is the first time it was seen on this machine or the time its driver changed — not every time it was plugged in.

What this answers, and what it does not

The log is a record of installs, not of insertions, and everything below follows from that one fact.

• It answers: was this device ever attached to this machine, and when was it first attached. Windows writes a section the first time it sees a device and when the driver changes. That first timestamp is good evidence and is often the one that matters.
• It does not answer: how many times, or how long for. Plugging in an already-installed drive writes nothing. A drive used every day for a year appears once. Nothing in this file counts insertions, and a tool that claimed to would be inventing it.
• A failed install still means the device was plugged in. Windows cannot install a driver it does not have, and the section it writes says FAILURE and a code. The device was physically connected all the same, which is why those rows are shown by default rather than filtered away as noise.
• The times are that machine's local clock. Not UTC, not yours. If the clock was wrong, the log is wrong in the same direction, and no tool can tell from the file alone.
• Absence is weak. The log is capped; when it fills, Windows renames it with a date and starts a new one. A device missing from the file you have may be in a backup beside it, and the backups are deleted routinely.
• A generated ID is not a serial number. A USB storage device that reports a serial has it in the last part of its instance ID. One that does not gets an ID Windows made up, and the test is the second character: an & there means generated. A generated ID identifies the device on that one computer and nowhere else, so matching one against another machine's log is a mistake that looks like a finding. Rows here say which kind each one is.
• This is one artefact. Corroborate it: the USBSTOR keys in the SYSTEM registry hive carry the same devices with their own timestamps, and the Windows event log records more. A conclusion resting on this file alone is resting on one leg.

If the copy of the log might be relied on, hash it before you read it — CHECKSUM takes a SHA-256 in the browser — and record where it came from with CHAIN. The first question asked of any examination is whether the copy examined is the copy received.