CODE FOR MY USB HISTORY DETAILS :
using System;using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Linq;
using System.Windows.Forms;
using Microsoft.Win32;
using System.Runtime.InteropServices;
using System.Data.SqlClient;
using System.Configuration;
using System.Diagnostics;
using Microsoft.Win32.SafeHandles;
namespace CPACT
{
public partial class USBHistory : Form
{
string usbStor = @"SYSTEM\ControlSet001\Enum\USBSTOR";
public USBHistory()
{
InitializeComponent();
USBHistory_Load();
}
[DllImport("shell32")]
static extern bool IsUserAnAdmin();
public class RegistryKeyEx
{
#region P/Invoke Declarations
// This declaration is intended to be used for the last write time only. int is used
// instead of more convenient types so that dummy values of 0 reduce verbosity.
[DllImport("advapi32.dll", EntryPoint = "RegQueryInfoKey", CallingConvention = CallingConvention.Winapi, SetLastError = true)]
extern private static int RegQueryInfoKey(
SafeRegistryHandle hkey,
int lpClass,
int lpcbClass,
int lpReserved,
int lpcSubKeys,
int lpcbMaxSubKeyLen,
int lpcbMaxClassLen,
int lpcValues,
int lpcbMaxValueNameLen,
int lpcbMaxValueLen,
int lpcbSecurityDescriptor,
IntPtr lpftLastWriteTime);
#endregion
#region Public Poperties
/// <summary>
/// Gets the registry key owned by the info object.
/// </summary>
public RegistryKey Key { get; private set; }
/// <summary>
/// Gets the last write time for the corresponding registry key.
/// </summary>
public DateTime LastWriteTime { get; private set; }
#endregion
/// <summary>
/// Creates and initializes a new RegistryKeyInfo object from the provided RegistryKey object.
/// </summary>
/// <param name="key">RegistryKey component providing a handle to the key.</param>
public RegistryKeyEx(RegistryKey key)
{
Key = key;
SetLastWriteTime();
}
/// <summary>
/// Creates and initializes a new RegistryKeyInfo object from a registry key path string.
/// </summary>
/// <param name="parent">Parent key for the key being loaded.</param>
/// <param name="keyName">Path to the registry key.</param>
public RegistryKeyEx(RegistryKey parent, string keyName)
: this(parent.OpenSubKey(keyName))
{ }
/// <summary>
/// Queries the currently set registry key through P/Invoke for the last write time.
/// </summary>
private void SetLastWriteTime()
{
Debug.Assert(Key != null, "RegistryKey component must be initialized");
GCHandle pin = new GCHandle();
long lastWriteTime = 0;
try
{
pin = GCHandle.Alloc(lastWriteTime, GCHandleType.Pinned);
if (RegQueryInfoKey(Key.Handle, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, pin.AddrOfPinnedObject()) == 0)
{
LastWriteTime = DateTime.FromFileTime((long)pin.Target);
}
else
{
LastWriteTime = DateTime.MinValue;
}
}
finally
{
if (pin.IsAllocated)
{
pin.Free();
}
}
}
}
private void USBHistory_Load()
{
DataTable dataGridView1 = new DataTable();
dataGridView1.Columns.Add("FriendlyName");
dataGridView1.Columns.Add("LastWriteTime");
dataGridView1.Columns.Add("Service");
dataGridView1.Columns.Add("ClassGUID");
dataGridView1.Columns.Add("Driver");
dataGridView1.Columns.Add("ContainerID");
using (var keyUsbStor = Registry.LocalMachine.OpenSubKey(usbStor))
{
var usbDevices = from className in keyUsbStor.GetSubKeyNames()
let keyUsbClass = keyUsbStor.OpenSubKey(className)
from instanceName in keyUsbClass.GetSubKeyNames()
let keyUsbInstance = new RegistryKeyEx(keyUsbClass.OpenSubKey(instanceName))
select new
{
UsbName = keyUsbInstance.Key.GetValue("FriendlyName"),
ConnectTime = keyUsbInstance.LastWriteTime,
Service = keyUsbInstance.Key.GetValue("Service"),
ClassGUID = keyUsbInstance.Key.GetValue("ClassGUID"),
Driver = keyUsbInstance.Key.GetValue("Driver"),
ContainerID = keyUsbInstance.Key.GetValue("ContainerID")
};
foreach (var usbDevice in usbDevices.OrderBy(x => x.ConnectTime))
{
dataGridView1.Rows.Add(usbDevice.UsbName, usbDevice.ConnectTime,usbDevice.Service,usbDevice.ClassGUID,usbDevice.Driver,usbDevice.ContainerID);
}
}
commonGridControl1.FillGridData(dataGridView1);
}
}
}
THE OUTPUT THAT I GET:
PROBLEM IS I CAN NOT GET THE ACTUAL TIMESTAMPS OF ANY USB DEVICE.
IF I CONNECT THE USB DEVICE CURRENTLY THEN THE TIME STAMP SHOULD REFLECT OF THE LAST CONNECTED TIME
BUT I AM NOT GETTING IT FROM THE REGISTRY IF ANYONE CAN HELP THAN IT WOULD BE GREAT
SHAH BHAUMIK A.