How to view log of hardware removal and connection?

Solution 1:

Your problem sound a bit strange, which is probably why nobody answered. But there are a few places that come to mind, where you may want to look. It's all in the registry, but it's hard to extract without proper forensic software. The simplest ways are these.

1. Open (admin) PowerShell and try to modify the queries to suit your purpose:

$Path = 'HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\*'
Get-ItemProperty -Path $Path | Select-Object -Property FriendlyName, CompatibleIDs, Mfg  

2. Look in the C:\Windows\inf\setupapi.dev.log. For example, using Cygwin:

less /cygdrive/c/Windows/Inf/setupapi.dev.log

More information on the log file can be found here. Specifically, if you set the DWORD to 00007070 in the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\LogLevel 

you get very verbose log.