How to find Windows 7 File Transfer History?
The only kind of trace available on Windows is the Windows Event, which could be accessed from the Windows Event Viewer, as shown below:
Unfortunately, I couldn't find (I suspect that anyone would) any specific event related with your problem (unauthorized file copies to flash drives).
I am almost sure that you will not be able to find if someone already did an unauthorized file copy from your system, but I could list two applications that would help to find if someone try the same thing in future:
- Diskmon:
DiskMon is an application that logs and displays all hard disk activity on a Windows system. You can also minimize DiskMon to your system tray where it acts as a disk light, presenting a green icon when there is disk-read activity and a red icon when there is disk-write activity.
- Capture Bat:
This is a behavioral analysis tool of applications for the Win32 operating system family. Capture BAT is able to monitor the state of a system during the execution of applications and processing of documents, which provides an analyst with insights on how the software operates even if no source code is available. Capture BAT monitors state changes on a low kernel level and can easily be used across various Win32 operating system versions and configurations. CaptureBAT is developed and maintained by Christian Seifert of the NZ Chapter.
Additionally, I would recommend you to use some kind of cryptography on your disk to protect your files from this kind of problem. Take a look on Truecrypt software.
Hope this information helps you some way.