Blocking is prevention; this page is detection. Windows quietly remembers every USB storage device that has ever been connected, and with one auditing setting switched on in advance, it can record file access on removable drives too. Here is where those records live.
After an incident the question is never whether USB should have been blocked - it is what was plugged into this PC, and when. Windows answers more of that than most people expect, for free, because it keeps a connection history for its own driver housekeeping. The honest split in this page: device history exists by default; file-level detail exists only if you switched auditing on before the event. Both are built in. Neither needs a tool download.
Open Registry Editor and look at HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. Every mass storage device ever connected leaves a subkey named from its make, model and serial number - Kingston DataTraveler, SanDisk Cruzer and friends appear in plain language. This key proves a device was connected at some point and identifies it. On a suspect PC it is the fastest first look there is: unexpected entries, especially personal drives on a billing machine, tell you where to dig next.
For when, use Device Manager. Enable View → Show hidden devices, find the drive under Disk drives (disconnected devices show greyed), open Properties and the Details tab, and read the time properties - First install time and Last arrival time are recorded for the device. The Event Viewer log Microsoft-Windows-DriverFrameworks-UserMode/Operational also records device arrival activity for the machine. Together they build a reasonable timeline: which drive, first seen when, last seen when.
Knowing a drive visited is not knowing what it copied. For that, Windows has a dedicated switch: in Local Security Policy go to Advanced Audit Policy Configuration → Object Access and enable Audit Removable Storage (Success). From then on, file access on removable storage is recorded in the Security log as Event 4663 entries naming the file and the user. Two honest warnings: it must be on before the incident - it cannot see backwards - and on busy PCs it generates volume, so review it on a schedule, not in a panic.
These records show devices and, with auditing, file access - they do not play back the session. An administrator can clear logs and edit history, which is why audit trails belong on PCs where daily users are standard accounts (the theme of the admin-exception page). And if your requirement is continuous per-file copy tracking with alerts across many PCs, that is genuine DLP tool territory - dedicated products, including the ManageEngine line covered elsewhere on this channel, exist for it. The built in records are for investigations and spot checks, and for that they are honestly good.
USBSTOR key on each sensitive PC; note any device that is not on your known listTen minutes a month keeps the history meaningful - a log nobody reads is a diary, not a control.
The video sets up the block. This page is its partner - the records that tell you what happened on the PCs you could not watch.
▶️ Watch Full VideoYes. The USBSTOR registry key and Device Manager's hidden devices both keep records of disconnected devices, including their identities and arrival times.
With Audit Removable Storage enabled beforehand, the Security log records file access attempts on removable drives, including the file path and user. Copying is a read from the source and a write to the drive - the removable side of that appears in these events.
An administrator can clear event logs and tamper with registry history. That is why investigations start from standard-user PCs seriously, and why serious environments forward logs to a server the local admin cannot touch.