On my system, from time to time there is an automatic mount/unmount of a plugged device. I guess it's done by some software on the machine. is there any way to monitor PnP mount/unmount events on the system and detect which application triggers the event (rather that uninstalling application after application)?
1 Answer
You can easily track events in the device manager (I am assuming Windows)
-Open Device manager -Find your device and Right Click -Select Properties -Click the Events Tab - select View All Events will take your to the event viewer with the filter for the device.
You can find quite a bit of data in - C:\Windows\INF\setupapi.dev.log (its hard to read but might help diagnose)
Or you can try USBLogView - http://www.nirsoft.net/utils/usb_log_view.html
-
But non of the suggested above can be used to find which software made the mount/unmount– DenisAug 25, 2015 at 16:20
-
@Denis - In the details of the events, you have ProcessID, and UserID. For most devices this will be PID 4 and
S-1-5-18but it may have the actual process ID. If there process is not running anymore you can use SysMon to log all process starts and then wait to the next mount to happen. Aug 25, 2015 at 16:46