Is it possible to check when the portable hard drive was last accessed

I live alone and I left home for a short trip 13 days ago, and turned off my computer and unplugged my portable drives before I left.
However, for some reasons, during the time, an unwelcome someone came to my home with a family member of mine and he is always a liar so they cannot be trusted.
OK. My question is, is it possible to check when my portable drives were last accessed or powered? I haven't plugged or powered any of my drives since I left and I came back. I only want to know if it's possible to know if those drives were ever powered or accessed when I was not there, and how?

Thanks.

When I plug in a drive I see in the System event log an event 98. You could open that log and filter to only show event 98s.

Here is a sample:

Another thought: If they plugged in an external drive before powering on the system you may not see these events, but since the system was turned off while you were away you would see other events logged during the time you were away IF the system was powered on. If the system was off, there should be no events during that time.

Finally, if you have sensitive info on any drives, you might consider using BitLocker to protect that data.

ccs\enum\usbstor has info on last used time for any usb attached devices.

hklm\system\currentcontrolset\enum\usbstor

export each key underneath as a txt file for easy reading.

EDIT:
I have just checked and on win11 it only shows the last write time

Yes, nir sofers little program is worth a try

LastActivityView - View the latest computer activity in Windows operating system

If those externals are usb nir sofers other tool will give you the plug and unplug time

USB Drive Log For Windows 10 and Windows 11

hsehestedt said:

Another thought: If they plugged in an external drive before powering on the system you may not see these events, but since the system was turned off while you were away you would see other events logged during the time you were away IF the system was powered on. If the system was off, there should be no events during that time.

Finally, if you have sensitive info on any drives, you might consider using BitLocker to protect that data.

Hi. I am not sure if my system was ON or OFF during the time I left because they could turn ON my computer or connect my portable hard drive to their own computer.

What I am concerned now is if I can check when my portable drives were last accessed, even if no file on the drive was read, edited or deleted, for example, they just connected it to a USB cable and then ejected it immediately, then I would know, Is it possible and how?

By the way, did you mean a user can also check when their computer was last turned ON or OFF?

- - - Updated - - -

Callender said:

If files/ folders were viewed:

Download LastActivityView - MajorGeeks

Anyway just password protect (encrypt) them.

SafeHouse Explorer - Create Password Protected USB | Tutorials

There are other ways.

NOTE: If you want to encrypt then you'd need to use a new USB drive to create the container on. Then you'd need to move your files into the container. That program won't encrypt files in place that are already on a drive.

That program is no longer available so if you want to try it:

Safehouse Explorer Portable

Hello. I mean, I left home for travel in late September, and I came back 4 days ago, computer was turned off and all of my portable hard drives were disconnected, but a family member of mine could come back and use my computer or even use my portable hard drives without my consent. I'd like to know if it's possible to check if those portable drives were once accessed (e.g. any file read/edited/deleted) during the time I left my home. Would the tool you recommend just update the last accessed time to NOW as soon as I connect the drives to my computer? In that case, it is meaningless. OK, let say, I'd like to know if my portable drives were once powered or accessed during the 30 Sep to 9 Oct, is it possible with the tool you recommend?

What I am concerned now is if I can check when my portable drives were last accessed, even if no file on the drive was read, edited or deleted, for example, they just connected it to a USB cable and then ejected it immediately, then I would know, Is it possible and how?

If you had read my last post you would know that nir sofers program will list the plug and unplug times ( and date ) for usb devices on your laptop.

It won't help if the external usb disks were plugged into a stranger's machine.

kenny2023 said:

Hi. I am not sure if my system was ON or OFF during the time I left because they could turn ON my computer or connect my portable hard drive to their own computer.

What I am concerned now is if I can check when my portable drives were last accessed, even if no file on the drive was read, edited or deleted, for example, they just connected it to a USB cable and then ejected it immediately, then I would know, Is it possible and how?

By the way, did you mean a user can also check when their computer was last turned ON or OFF?

- - - Updated - - -



Hello. I mean, I left home for travel in late September, and I came back 4 days ago, computer was turned off and all of my portable hard drives were disconnected, but a family member of mine could come back and use my computer or even use my portable hard drives without my consent. I'd like to know if it's possible to check if those portable drives were once accessed (e.g. any file read/edited/deleted) during the time I left my home. Would the tool you recommend just update the last accessed time to NOW as soon as I connect the drives to my computer? In that case, it is meaningless. OK, let say, I'd like to know if my portable drives were once powered or accessed during the 30 Sep to 9 Oct, is it possible with the tool you recommend?

Using the event logs you can figure all that out. Try it. Connect a drive to an already on system and you will see the event 98s logged. If the system was off and turned on, you will a whole bunch of events logged as the system starts and runs. In that case, simply look for any activity at all during the time period in question.