This is my first post so will make it a quickie,
Where does USBDeview get the last Plug/Unplug time from for a memory stick? Which updates even if no file are written to the usb device.
I assume the last write time in the registry just refers to the last time a file was written to the stick?
Thanks for any help
According to some tests I did and the notes from the author, Plug/Unplug is only valid on live systems until the next time the computer is shutdown.
I watched what the prog did using Process Monitor, I could only find it reading reg keys for my test USB connection, specifically enum\usb. I did not find it reading setupapi.log file.
I would be interested as well knowing for sure exactly where this tidbit of info comes from, if not from the enum registry key last written times.
If I had to postulate, I would say that the prog looks at the reg key and determines if it is connected now or not. If connected now, then last plugin time would be last written time for its key. If it was not connected at last boot time, then there is no last plugin time. If you then remove it, USBDeview notes the change in the key to 'not connected' and updates the last plug/unplug time with the new last written time of its key.
Seems it just applies a little logic to the data we are given.
If anyone has specific info on what code generates this value, I hope you post it here.
Regards,
MarkG
Where does USBDeview get the last Plug/Unplug time from for a memory stick? Which updates even if no file are written to the usb device.
Have you checked the author's web site?
I assume the last write time in the registry just refers to the last time a file was written to the stick?
Registry key LastWrite times are specific to keys and have nothing to directly to do with file MAC times.
It must be on web site of Author. Just contact author by mail or call if number is available. You will surely get your answer from him. Because it if you want perfect answer then it is the best way for that.