0

I would like to check when was the last time (with date) a particular SSD was detached from my computer (Windows 7).

I know that I can find some information on the registry and on the event log, but I´m not finding anything useful, such as an error due to detaching the device or a specific event.

I know also that there are tools such as USBDeview that shows the history of connected USB and flash drives, but I haven't found anything similar for hard drives.

Any ideas?

Edit 1: With RegScanner: https://www.nirsoft.net/utils/regscanner.html I have been able to see some registry keys with their corresponding dates. However, I'm not able to understard what those registry entries mean exactly. On 23/09/2020 I already noticed that the device has been removed, so the device must has been removed previously. Is 26/08/2020 the last time the device was abailiable?

enter image description here

There are also some events matching those dates saying, for example, that F:/ (the volume of the SSD is not accesible anymore).

enter image description here

However, I know that around that time the computer was rebooted. Does it mean that the device is detached in that moment, or could has been detached before and notified on the registry after the reboot?

Any other ideas will be welcome.

Improve this question
5
  • I would like to know the last time it was connected to the computer (i.e when it was detached). Sorry for my bad english, I will edit the question to avoid confusion. And yes, it is a particular SSD. Is that relevant or could it be helpful? I have tried to found the brand in the registry but I didn´t found anything useful. Thanks.
    – kevin
    Commented Sep 30, 2020 at 6:13
  • I am trying to understand a use case, say SSD in question is connected to a SATA port in your Windows 7 PC. Say on 1-Sep-2020 you run the system for 2 days and then shut it down on 3-Sep. PC remains off and you remove the drive on 4-Sep when PC was off, then for another 2 days PC is off and then later you power it on, on 7-Sep. Now what info you want to capture in this case?
    – patkim
    Commented Oct 2, 2020 at 8:12
  • For that use case, I would like to capture information showing that the disc has been removed. E.g., an error produced on the day 4-Sep due to detaching the drive, a change in the system configuration with date 4-Sep on which it pass from having 2 drives to having 1 drive...
    – kevin
    Commented Oct 2, 2020 at 9:36
  • Do you need a solution that works on any Windows 7 with default(ish) config, retroactively? (e.g. because somebody has already detached an important disk and you want to know when it was; and you hope the OS stores such information by itself, so you just need to find it). Or do you allow configuring or installing something that would log changes from now on? (i.e. without any ability to tell what happened before the configuration or installation).
    – Kamil Maciorowski
    Commented Oct 2, 2020 at 10:29
  • 1st case: I would like a solution (if it is possible) that works on a windows with default configuration retroactively.
    – kevin
    Commented Oct 2, 2020 at 11:23

1 Answer 1

Reset to default
0

You can make an application in C/C++ or .NET/C# and hook up to system call when the drives are attached or detached. It is possible that you would need to attach in code to some system .DLL file and hook it up with own procedure to do what you need. In code you can check if the SSD you are looking for is detached in this moment and make own procedure based on this event.

Take a look here:

https://stackoverflow.com/questions/1783657/get-notification-when-a-new-drive-is-connected-via-usb-or-other-means-c

Improve this answer
2
  • Sorry but I would like to know when the SSD was detached in the past (It is no accessible anymore). Thus, although your proposal could be interesting, I'm not sure that it could be applied in this case.
    – kevin
    Commented Oct 6, 2020 at 15:54
  • @kevin beside Event Log in Windows you have no chance to know that. Eventually logging everything by application and later using the logged data.
    – pbies
    Commented Oct 6, 2020 at 17:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .