Event Viewer
Can Event Viewer tell you if a portable device was plugged in to your PC and used to copy a file?
Comments
-
buzzkill
Member Posts: 95 ■■□□□□□□□□
You will have needed to enable the audit object access group policy for it to show activities performed on files and folders, as well as enabled auditing on the folders/files in question. So no is probably the answer to that!
However there will be something in the system log that showed the portable device service start running. This will likely only show once per session so if you already had one plugged in you may not see this at the time you suspect, worth a look anyway.