Windows 10: USB trace

  1.    31 May 2018 #1

    USB trace


    I try to find out why this event occour in win 10, someting about an USB flash?

    Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">- <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />

    <EventID>15</EventID>

    <Version>0</Version>

    <Level>4</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8000000000000000</Keywords>

    <TimeCreated SystemTime="2016-10-27T10:46:12.959095100Z" />

    <EventRecordID>3931</EventRecordID>

    <Correlation />

    <Execution ProcessID="4592" ThreadID="7092" />

    <Channel>System</Channel>

    <Computer>AndersH2015</Computer>

    <Security UserID="S-1-5-18" />

    </System>


    - <EventData>
    <Data Name="HiveNameLength">78</Data>

    <Data Name="HiveName">\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\WINDOWS\System32\config\SYSTEM</Data>

    <Data Name="OriginalSize">16621568</Data>

    <Data Name="NewSize">16494592</Data>

    </EventData>


    </Event>




    Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">- <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>11</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2016-10-27T10:46:12.971887400Z" />
    <EventRecordID>3932</EventRecordID>
    <Correlation />
    <Execution ProcessID="4592" ThreadID="7092" />
    <Channel>System</Channel>
    <Computer>AndersH2015</Computer>
    <Security UserID="S-1-5-18" />
    </System>


    - <EventData>
    <Data Name="ExtraStringLength">78</Data>
    <Data Name="ExtraString">\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\WINDOWS\System32\config\SYSTEM</Data>
    <Data Name="TmId">{3E7EE446-9B5D-11E6-8328-54271ED3A836}</Data>
    <Data Name="RmId">{3E7EE445-9B5D-11E6-8328-54271ED3A836}</Data>
    <Data Name="Status">0xc00000a2</Data>
    <Data Name="InternalCode">7</Data>
    </EventData>


    </Event>








      My ComputerSystem Spec

  2. AndreTen's Avatar
    Posts : 14,166
    Windows 10 (Pro and Insider Pro)
       03 Jun 2018 #2

    You could try Nirsoft's USBLogView. Much more user friendly :)
      My ComputersSystem Spec

  3.    04 Jun 2018 #3

    AndreTen said: View Post
    You could try Nirsoft's USBLogView. Much more user friendly :)
    I have check a few program like nirsoft but the program cant shows for how long time the USB was mounted on the computer, so i have to find other ways like the event log:)
      My ComputerSystem Spec

  4. AndreTen's Avatar
    Posts : 14,166
    Windows 10 (Pro and Insider Pro)
       04 Jun 2018 #4

    Anders2201 said: View Post
    I have check a few program like nirsoft but the program cant shows for how long time the USB was mounted on the computer, so i have to find other ways like the event log:)
    Check Usbdevices viewer by vurdalakov. Shows connections and disconnection

    there is also one Microsoft utility.. on Ghostview
      My ComputersSystem Spec

  5.    04 Jun 2018 #5

    There are also another problem, i dont think the USB was register correct because a have a lot of problem with this USB before.
    I use three diffrent USB a specific date (all this USB was not installed at same time) and the last one was not register, so thats is another problem to find traces, try to find in the boot event or other event in the log, there is one trace in the setupapi log, event device uppdaterad and the S/N on the USB showing up.
      My ComputerSystem Spec


 

Related Threads
Muroc System Trace in General Support
Hi! Does anyone have any idea about what Event ID 2 Kernel-EventTracing 'Session Muroc System Trace failed to start 0xC0000035' means? It appeared once today, after a restart of the system not again. Is it something serious or just one of those...
All of a sudden my SSD laptop went from 8 second boot times to 16 seconds for no reason at all. It is hanging for quite some time before the login screen so I want to see what is going on there. Is there a way to trace the boot to see where it is...
BSOD Random Error, Can't Trace to Fix. in BSOD Crashes and Debugging
I have been getting random BSOD errors on my Windows 10 computer. Most often they occur when I go on the web in Facebook and try to go into videos or news sites. Here lately, it has also been occurring when working in the File explorer and also some...
Windows 10 10586.545 After closing all applications the way it should (File->Exit) it happens that Windows does not shut down at all. It does not go any further that this 'Shutting down" screen. Nothing is happening, not after 1 hour, 2 hours....
Cannot trace down why multiple PCs are waking in Performance & Maintenance
Was running W7 Pro and 8.1 on another. Upgraded to 10 last week. Every since then both totally different machines (diff prev OS, diff MB, etc) wake up in the middle of the night. Is there some way to trace down what is doing it? Looked at this so...
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 02:56.
Find Us