如何搜索USB设备事件 [英] How to Search for USB device events

问题描述

我需要在许多客户端中搜索USB存储设备的插入/删除时间，并将数据存储在中央SQL DB上。我还需要设备ID和VID，以便在基于USB设备ID在特定客户端上插入特定USB设备的情况下，在中央面板上生成可视指示。



首先，我想找到插入和删除的USB设备列表。如何使用C＃/ vb.net？

I need to search for the insertion/ removal time of USB storage devices in a number of clients and store the data on a central SQL DB. I also need the device ID, and VID, so as to have a provision of generating a visual indication at a central panel in case of insertion of specific USB devices on specific clients based on USB Device ID.

To start with, I want to find the list of USB devices inserted and removed. How can I do that with C#/ vb.net?

推荐答案

请参阅此CodeProject文章：检测硬件插入和/或移除 [ ^ ]。



与C＃一起使用，你仍然需要使用一些本机代码（可能只是调用原始Windows API的包装器）并且需要使用P / Invoke：

http://en.wikipedia.org/wiki/P/Invoke [ ^ ]，

http://msdn.microsoft.com/library/en-us/vcmxspec/html/vcmg_PlatformInvocationServices.asp [ ^ ]。



还有另一种方式：通过 WMI （System.Management ）。但这是一种假的方法：它只是基于定期轮询系统。我不建议用它来检测事件。

-SA

Please see this CodeProject article: Detecting Hardware Insertion and/or Removal[^].

To use it with C#, you still need to have some native code using (maybe just wrappers for the call of raw Windows API) and would need to use P/Invoke:
http://en.wikipedia.org/wiki/P/Invoke[^],
http://msdn.microsoft.com/library/en-us/vcmxspec/html/vcmg_PlatformInvocationServices.asp[^].

There is another way: through WMI (System.Management). But this is a kind of a fake approach: it is simply based on periodic polling the the system. I would not recommend using it for detecting events.

—SA

大家好，



感谢您的建议。



我找到一个用于获取过去连接和删除的USB设备列表的选项来自Windows事件日志。在系统日志中，在EventID 20001下，可以检测到USB设备。请参考Yogesh Khatri http ：//www.swiftforensics.com/2012/08/tracking-usb-first-insertion-in-event.html [ ^ ]和Jason Hale在 http://dfstream.blogspot.in/2014/01/the -windows-7-event-log-and-usb-device.html [ ^ ]。此后，问题是如何使用C＃或vb.net从这些事件日志条目中获取我想要的详细信息，例如设备ID，供应商ID，连接/断开连接时间等。 上的这篇文章如何检测USB记忆棒的插入？ [ ^ ]给了我更多指示。

Hi all,

Thanks for the advises.

One option I found for getting the list of USB devices connected and removed in the past is from the Windows Event Log. In System Log, under EventID 20001, the detection of USB Devices are available. Please refer Yogesh Khatri http://www.swiftforensics.com/2012/08/tracking-usb-first-insertion-in-event.html[^] and Jason Hale at http://dfstream.blogspot.in/2014/01/the-windows-7-event-log-and-usb-device.html[^]. Thereafter the question is how to get the details I wanted from these Event Log entries, such as device ID, Vendor ID, Time of connection/ disconnection, etc, using C# or vb.net. This post on how to detect insertion of USB stick ?[^] gave me some more directions.

Windows没有维护任何此类设备插入/删除日志，因此您的应用是在你开始之前死在水里。

Windows doesn't maintain any such log of device insert/removals so your app is dead in the water before you even begin.

这篇关于如何搜索USB设备事件的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！