Is it possible to check when the portable hard drive was last accessed

Callender · 13 Oct 2023

Last activity view shows on/ off times.

Callender · 13 Oct 2023

Just run the program. It will show all files viewed on all dates on all drives. It will show all startup/ shutdown/ user logon/ logoff times on all dates. Try the program then ask the questions. There's nothing to install. It's portable. If you don't like it just delete the folder.

Callender · 13 Oct 2023

If you just want last access time:

Download - Shellbags AnalyZer + Cleaner

Is it possible to check when the portable hard drive was last accessed-shell-bags-cleaner.jpg

Paul Black · 13 Oct 2023

Hello @kenny2023,

kenny2023 said:

Is it possible to check when my portable drives were last accessed or powered?

Using Windows WinEvent > Id=98, does this help ?

Copy & Paste the following command into a CMD Prompt and press Enter. It will create a WinEvent_98.log file on your Desktop. If you have a relocated Desktop, then change the output Path accordingly.

Code:


PowerShell "Get-WinEvent -FilterHashtable @{LogName='System'; Id=98} -ErrorAction 'SilentlyContinue' | Format-Table ProviderName, TimeCreated, RecordID, LevelDisplayName, Id, Message -Autosize | Out-String -Width 1000 > %UserProfile%\Desktop\WinEvent_98.log"

I hope this helps.

kenny2023 · 13 Oct 2023

Callender said:

Just run the program. It will show all files viewed on all dates on all drives. It will show all startup/ shutdown/ user logon/ logoff times on all dates. Try the program then ask the questions. There's nothing to install. It's portable. If you don't like it just delete the folder.

What do you mean by it will show all dates on all drives? Does it not only show the last accessed date but also show some earlier dates before the last accessed dates? I wouldn't mind trying the program but I am worried that once my portable drives are connected and powered the last accessed dates will be updated or erased so I will not be able to know if my portable drives are used without my consent during the time I left for trip.(After I came back, I haven't yet powered any portable hard drives.)

Callender · 13 Oct 2023

You don't need the drives to be connected to use that program. I give up.

Callender · 13 Oct 2023

Anyway if you don't want to run that program just check shell bags as per Post #13.

Callender · 13 Oct 2023

Unsubscribed.

mngerhold · 13 Oct 2023

Some of you seemed to have missed his concern: his USB drives may have been plugged into another PC over which he has no control or knowledge. Can he tell if they have been powered on in that case? I think the answer is 'no'. As others have suggested, encrypt the drives (or files in them).

Callender · 13 Oct 2023

mngerhold said:

Some of you seemed to have missed his concern: his USB drives may have been plugged into another PC over which he has no control or knowledge. Can he tell if they have been powered on in that case? I think the answer is 'no'. As others have suggested, encrypt the drives (or files in them).

Thanks. Ditto on encryption.