Can anyone suggest a quick way to determine if a USB device which was previously plugged into a Win7 (ultimate, 64bit) system was USB 2 or 3?
Thanks in advance
This may harder than you think because I am fairly certain a USB 3 drive will work with a USB 2 cable, hence in USB 2 mode.
One possible clutching at staws answer maybe the speed of any files transfered. USB 3 is much faster
you hit the nail right on the head - a usb3 port will accept a usb 2 device - and i can't find any info (so far) which explicitly tells me what version an inserted device was.
file transfer speed would indeed be something to look at and actually has direct relevance to the issue behind these questions - can you suggest where one might look for information on that?
Is there anything in USBStor etc such as a VID/PID that might indicate what has been attached
Can I ask why you'd need to know?
Paul - frustratingly no
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt\_??_USBSTOR#Disk&Ven_Unknown&Prod_Generic&Rev_1100#AA70000000000111&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}UNKNOWN_2142862906
Johnathan, it's all about copy speed. It's asserted that during a certain time window a specific file was copied from a machine. Given the size of the file and the time window involved (and the types of port available on the machine), the only way that could have taken place is if a USB 3 drive were used to do the transfer. The machine is USB3 capable.
Johnathan, it's all about copy speed. It's asserted that during a certain time window a specific file was copied from a machine. Given the size of the file and the time window involved (and the types of port available on the machine), the only way that could have taken place is if a USB 3 drive were used to do the transfer. The machine is USB3 capable.
I see! Have you parsed any existing lnk files from the time frame in question for any info which may help? Thinking if the user opened any files on the remote device once copied over and the remote volume name may be indicative. Anything in setupapi.log?
If you have a USB3 device to hand you could try plugging it into a 'fresh' OS install with Mark Russinovich's Process Monitor running with the appropriate filters set, see what it does, then do the same with a USB2 device and see if it differs.
Thanks for all the suggestions - I was hoping for a quick and dirty pointer but I see I have more work to do. I'll post back to this list when I'm done testing with a USB 3 drive and comparing what gets logged with a USB 2.