Starting from this great script offered by Daniel Azuelos

cd /Volumes/suspicious_USB
/usr/bin/sudo find . -atime -21 -exec ls -dluT {} \;

How is it possible to modify it in order to find if a USB flash was plugged in, on any random computer, on a certain date?


In Linux, there is a USB subsystem which creates system log events.

So it can tell you what was plugged into your PC. But it can’t in general tell whether it's a USB stick or something else connected to a PC, unless some files were changed. While USB sticks and SD cards are usually formatted as VFAT for compatibility, there’s no reason they can’t be formatted with a more powerful filesystem such as EXT3 or NTFS. In which case, if a USB stick was mounted read-write and not “noatime”, the file access timestamp would indicate if a file had been read, or if a directory had been accessed by a graphical desktop to create folder icons.

Since this is built-in to Linux and is part of the USB specification, it must be possible to get the same level of detail in other operating systems using an appropriate application.

|improve this answer|||||

Not the answer you're looking for? Browse other questions tagged .