This is all done within the registry and not a log file unless some third party synchronization software was used. There are unique descriptors created for each device that lists information like what kind of device it is, number of endpoints, etc.
You can read more about descriptors here: http://www.beyondlogic.org/usbnutshell/usb5.htm To get more information on the device itself, check out these keys: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR To get more information on files check out the Most Recently Used (MRU) keys: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU Also: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs I would check these areas and see if any files match up to the location/device of the USB flash drive in question. Hopefully the clear list feature isnt selected for the recent opened documents. If so, it could clear the locations above. Another area I would check is the information within the virtual memory, as well as the memory management key within the registry since it holds the virtual memory configuration: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management Helpful tools: UVCView http://www.microsoft.com/whdc/device/stream/vidcap/UVCview.mspx USB Vendor ID List: http://www.linux-usb.org/usb.ids USB Specification download the latest version. Check out section 9.5, 9.6, and 9.7 http://www.usb.org/developers/docs As for the post about the DLT Service . I believe that just monitors NTFS volumes and since most flash drives like USB drives are FAT32, I am not sure if the DLT client service will be much help. Still, maybe worth a look though. Good luck!
