none
I am trying to find out if this coworker who was using my laptop with his USB plugged in, stole/copied any file or folder while I was away. How to find out?I Codes from "C:\Windows\INF\setupapi.dev.log" are as follows:- RRS feed

  • Question

  • >>>  [Device Install (Hardware initiated) - SWD\WPDBUSENUM\_??_USBSTOR#Disk&Ven_SanDisk&Prod_Cruzer_Glide&Rev_1.26#20043512330A6D835C8D&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}]
    >>>  Section start 2016/10/18 21:51:06.291
         dvi: {Build Driver List} 21:51:07.217
         dvi:      Searching for compatible ID(s):
         dvi:           wpdbusenum\fs
         dvi:           swd\generic
         dvi:      Created Driver Node:
         dvi:           HardwareID   - wpdbusenum\fs
         dvi:           InfName      - C:\WINDOWS\System32\DriverStore\FileRepository\wpdfs.inf_amd64_4b4cfcfa114bdc22\wpdfs.inf
         dvi:           DevDesc      - WPD FileSystem Volume Driver
         dvi:           Section      - Basic_Install
         dvi:           Rank         - 0x00ff2000
         dvi:           Signer Score - INBOX
         dvi:           DrvDate      - 06/21/2006
         dvi:           Version      - 10.0.14393.0
         dvi: {Build Driver List - exit(0x00000000)} 21:51:07.437
         dvi: {DIF_SELECTBESTCOMPATDRV} 21:51:07.439
         dvi:      Using exported function 'WpdClassInstaller' in module 'C:\WINDOWS\system32\wpd_ci.dll'.
         dvi:      Class installer == wpd_ci.dll,WpdClassInstaller
         dvi:      Class installer: Enter 21:51:07.537
         dvi:      Class installer: Exit
         dvi:      Default installer: Enter 21:51:07.540
         dvi:           {Select Best Driver}
         dvi:                Class GUID of device changed to: {eec5ad98-8080-425f-922a-dabf3de3f69a}.
         dvi:                {DIF_DESTROYPRIVATEDATA} 21:51:07.544
         dvi:                     Class installer: Enter 21:51:07.546
         dvi:                     Class installer: Exit
         dvi:                     Default installer: Enter 21:51:07.548
         dvi:                     Default installer: Exit
         dvi:                {DIF_DESTROYPRIVATEDATA - exit(0xe000020e)} 21:51:07.551
         dvi:                Selected:
         dvi:                     Description - [WPD FileSystem Volume Driver]
         dvi:                     InfFile     - [c:\windows\system32\driverstore\filerepository\wpdfs.inf_amd64_4b4cfcfa114bdc22\wpdfs.inf]
         dvi:                     Section     - [Basic_Install]
         dvi:           {Select Best Driver - exit(0x00000000)}
         dvi:      Default installer: Exit
         dvi: {DIF_SELECTBESTCOMPATDRV - exit(0x00000000)} 21:51:07.562
         ndv: {Core Device Install} 21:51:07.564
         ndv:      {Install Device - SWD\WPDBUSENUM\_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER_GLIDE&REV_1.26#20043512330A6D835C8D&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}} 21:51:07.573
         ndv:           Parent device: STORAGE\Volume\_??_USBSTOR#Disk&Ven_SanDisk&Prod_Cruzer_Glide&Rev_1.26#20043512330A6D835C8D&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
         ndv:           {Configure Device - SWD\WPDBUSENUM\_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER_GLIDE&REV_1.26#20043512330A6D835C8D&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}} 21:51:07.608
         ndv:                Parent device: STORAGE\Volume\_??_USBSTOR#Disk&Ven_SanDisk&Prod_Cruzer_Glide&Rev_1.26#20043512330A6D835C8D&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
    !    ndv:                Device class {eec5ad98-8080-425f-922a-dabf3de3f69a} is not configurable.
         ndv:           {Configure Device - exit(0x00000032)} 21:51:07.619
         dvi:           {DIF_ALLOW_INSTALL} 21:51:07.620
         dvi:                Using exported function 'WpdClassInstaller' in module 'C:\WINDOWS\system32\wpd_ci.dll'.
         dvi:                Class installer == wpd_ci.dll,WpdClassInstaller
         dvi:                Using exported function 'CoDeviceInstall' in module 'C:\WINDOWS\system32\WUDFCoinstaller.dll'.
         dvi:                CoInstaller 1 == WUDFCoinstaller.dll
         dvi:                CoInstaller 1: Enter 21:51:07.761
         dvi:                CoInstaller 1: Exit
         dvi:                Class installer: Enter 21:51:07.765
         dvi:                Class installer: Exit
         dvi:                Default installer: Enter 21:51:07.776
         dvi:                Default installer: Exit
         dvi:           {DIF_ALLOW_INSTALL - exit(0xe000020e)} 21:51:07.781
         dvi:           {DIF_INSTALLDEVICEFILES} 21:51:07.784
         dvi:                CoInstaller 1: Enter 21:51:07.786
         dvi:                CoInstaller 1: Exit
         dvi:                Class installer: Enter 21:51:07.813
         dvi:                Class installer: Exit
         dvi:                Default installer: Enter 21:51:07.819
         dvi:                Default installer: Exit
         dvi:           {DIF_INSTALLDEVICEFILES - exit(0x00000000)} 21:51:07.833
         flq:           File 'C:\WINDOWS\system32\DRIVERS\UMDF\WpdFs.dll' pruned from copy.
         dvi:           {DIF_REGISTER_COINSTALLERS} 21:51:08.239
         dvi:                Reset Device: Resetting device configuration. 21:51:08.243
    !    dvi:                Reset Device: Resetting device configuration failed : 0x0d 21:51:08.244
         dvi:                CoInstaller 1: Enter 21:51:08.246
         dvi:                CoInstaller 1: Exit
         dvi:                Class installer: Enter 21:51:08.248
         dvi:                Class installer: Exit
         dvi:                Default installer: Enter 21:51:08.251
         dvi:                     {DIF_DESTROYPRIVATEDATA} 21:51:08.269
         dvi:                          CoInstaller 1: Enter 21:51:08.271
         dvi:                          CoInstaller 1: Exit
         dvi:                          Class installer: Enter 21:51:08.273
         dvi:                          Class installer: Exit
         dvi:                          Default installer: Enter 21:51:08.276
         dvi:                          Default installer: Exit
         dvi:                     {DIF_DESTROYPRIVATEDATA - exit(0xe000020e)} 21:51:08.279
         dvi:                Default installer: Exit
         dvi:           {DIF_REGISTER_COINSTALLERS - exit(0x00000000)} 21:51:08.282
         dvi:           {DIF_INSTALLINTERFACES} 21:51:08.283
         dvi:                Using exported function 'CoDeviceInstall' in module 'C:\WINDOWS\system32\WUDFCoInstaller.dll'.
         dvi:                CoInstaller 1 == WUDFCoInstaller.dll
         dvi:                CoInstaller 1: Enter 21:51:08.289
         dvi:                CoInstaller 1: Exit
         dvi:                Class installer: Enter 21:51:08.292
         dvi:                Class installer: Exit
         dvi:                Default installer: Enter 21:51:08.296
         dvi:                Default installer: Exit
         dvi:           {DIF_INSTALLINTERFACES - exit(0x00000000)} 21:51:08.302
         dvi:           {DIF_INSTALLDEVICE} 21:51:08.305
         dvi:                CoInstaller 1: Enter 21:51:08.307
         dvi:                CoInstaller 1: Exit
         dvi:                Class installer: Enter 21:51:08.719
         dvi:                     {Install DEVICE}
         dvi:                          {Writing Device Properties}
         dvi:                               Strong Name=WpdFs.inf:0c0663c081fd6f5b:Basic_Install:10.0.14393.0:wpdbusenum\fs
         dvi:                          {Writing Device Properties - Complete}
         inf:                          AddService=WUDFWpdFs,0x000001fa,WUDFWpdFs_ServiceInstall  (wpdfs.inf line 38)
         dvi:                          Add Service: Modified existing service 'WUDFWpdFs'.
         dvi:                     {Install DEVICE exit (0x00000000)}
         dvi:                     Install Device: Configuring device class. 21:51:08.959
    !    dvi:                     Install Device: Configuring device class failed : 0x0d 21:51:08.960
         dvi:                     Install Device: Removing device sub-tree. 21:51:08.961
         dvi:                     Install Device: Removing device sub-tree completed. 21:51:09.068
         dvi:                Class installer: Exit
         dvi:                CoInstaller 1: Enter (Post Processing) 21:51:09.099
         dvi:                CoInstaller 1: Exit (Post Processing)
         dvi:           {DIF_INSTALLDEVICE - exit(0x00000000)} 21:51:09.147
         dvi:           {DIF_NEWDEVICEWIZARD_FINISHINSTALL} 21:51:09.149
         dvi:                CoInstaller 1: Enter 21:51:09.150
         dvi:                CoInstaller 1: Exit
         dvi:                Class installer: Enter 21:51:09.152
         dvi:                Class installer: Exit
         dvi:           {DIF_NEWDEVICEWIZARD_FINISHINSTALL - exit(0x00000000)} 21:51:09.182
         ndv:      {Install Device - exit(0x00000000)} 21:51:09.228
         ndv: {Core Device Install - exit(0x00000000)} 21:51:09.229
         dvi: {DIF_DESTROYPRIVATEDATA} 21:51:09.230
         dvi:      CoInstaller 1: Enter 21:51:09.231
         dvi:      CoInstaller 1: Exit
         dvi:      Class installer: Enter 21:51:09.234
         dvi:      Class installer: Exit
         dvi:      Default installer: Enter 21:51:09.236
         dvi:      Default installer: Exit
         dvi: {DIF_DESTROYPRIVATEDATA - exit(0xe000020e)} 21:51:09.238
    <<<  Section end 2016/10/18 21:51:09.250
    <<<  [Exit status: SUCCESS]


    >>>  [Device Install (Hardware initiated) - SWD\WPDBUSENUM\_??_USBSTOR#Disk&Ven_SanDisk&Prod_Cruzer_Glide&Rev_1.26#20043512330A6D835C8D&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}]
    >>>  Section start 2016/10/18 21:52:41.502
         dvi: {Build Driver List} 21:52:41.535
         dvi:      Searching for compatible ID(s):
         dvi:           wpdbusenum\fs
         dvi:           swd\generic
         dvi:      Created Driver Node:
         dvi:           HardwareID   - wpdbusenum\fs
         dvi:           InfName      - C:\WINDOWS\System32\DriverStore\FileRepository\wpdfs.inf_amd64_4b4cfcfa114bdc22\wpdfs.inf
         dvi:           DevDesc      - WPD FileSystem Volume Driver
         dvi:           Section      - Basic_Install
         dvi:           Rank         - 0x00ff2000
         dvi:           Signer Score - INBOX
         dvi:           DrvDate      - 06/21/2006
         dvi:           Version      - 10.0.14393.0
         dvi: {Build Driver List - exit(0x00000000)} 21:52:41.571
         dvi: {DIF_SELECTBESTCOMPATDRV} 21:52:41.572
         dvi:      Using exported function 'WpdClassInstaller' in module 'C:\WINDOWS\system32\wpd_ci.dll'.
         dvi:      Class installer == wpd_ci.dll,WpdClassInstaller
         dvi:      Using exported function 'CoDeviceInstall' in module 'C:\WINDOWS\system32\WUDFCoInstaller.dll'.
         dvi:      CoInstaller 1 == WUDFCoInstaller.dll
         dvi:      CoInstaller 1: Enter 21:52:41.596
         dvi:      CoInstaller 1: Exit
         dvi:      Class installer: Enter 21:52:41.599
         dvi:      Class installer: Exit
         dvi:      Default installer: Enter 21:52:41.602
         dvi:           {Select Best Driver}
         dvi:                Class GUID of device remains: {eec5ad98-8080-425f-922a-dabf3de3f69a}.
         dvi:                Selected:
         dvi:                     Description - [WPD FileSystem Volume Driver]
         dvi:                     InfFile     - [c:\windows\system32\driverstore\filerepository\wpdfs.inf_amd64_4b4cfcfa114bdc22\wpdfs.inf]
         dvi:                     Section     - [Basic_Install]
         dvi:           {Select Best Driver - exit(0x00000000)}
         dvi:      Default installer: Exit
         dvi: {DIF_SELECTBESTCOMPATDRV - exit(0x00000000)} 21:52:41.614
         ndv: {Core Device Install} 21:52:41.615
         ndv:      {Install Device - SWD\WPDBUSENUM\_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER_GLIDE&REV_1.26#20043512330A6D835C8D&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}} 21:52:41.624
         ndv:           Parent device: STORAGE\Volume\_??_USBSTOR#Disk&Ven_SanDisk&Prod_Cruzer_Glide&Rev_1.26#20043512330A6D835C8D&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
         ndv:           {Configure Device - SWD\WPDBUSENUM\_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER_GLIDE&REV_1.26#20043512330A6D835C8D&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}} 21:52:41.640
         ndv:                Parent device: STORAGE\Volume\_??_USBSTOR#Disk&Ven_SanDisk&Prod_Cruzer_Glide&Rev_1.26#20043512330A6D835C8D&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
    !    ndv:                Device class {eec5ad98-8080-425f-922a-dabf3de3f69a} is not configurable.
         ndv:           {Configure Device - exit(0x00000032)} 21:52:41.649
         dvi:           {DIF_ALLOW_INSTALL} 21:52:41.650
         dvi:                CoInstaller 1: Enter 21:52:41.651
         dvi:                CoInstaller 1: Exit
         dvi:                Class installer: Enter 21:52:41.654
         dvi:                Class installer: Exit
         dvi:                Default installer: Enter 21:52:41.663
         dvi:                Default installer: Exit
         dvi:           {DIF_ALLOW_INSTALL - exit(0xe000020e)} 21:52:41.666
         dvi:           {DIF_INSTALLDEVICEFILES} 21:52:41.669
         dvi:                CoInstaller 1: Enter 21:52:41.670
         dvi:                CoInstaller 1: Exit
         dvi:                Class installer: Enter 21:52:41.673
         dvi:                Class installer: Exit
         dvi:                Default installer: Enter 21:52:41.675
         dvi:                Default installer: Exit
         dvi:           {DIF_INSTALLDEVICEFILES - exit(0x00000000)} 21:52:41.685
         flq:           File 'C:\WINDOWS\system32\DRIVERS\UMDF\WpdFs.dll' pruned from copy.
         dvi:           {DIF_REGISTER_COINSTALLERS} 21:52:41.858
         dvi:                Reset Device: Resetting device configuration. 21:52:41.863
         dvi:                Reset Device: Resetting device configuration completed. 21:52:41.877
         dvi:                CoInstaller 1: Enter 21:52:41.879
         dvi:                CoInstaller 1: Exit
         dvi:                Class installer: Enter 21:52:41.888
         dvi:                Class installer: Exit
         dvi:                Default installer: Enter 21:52:41.900
         dvi:                     {DIF_DESTROYPRIVATEDATA} 21:52:41.910
         dvi:                          CoInstaller 1: Enter 21:52:41.912
         dvi:                          CoInstaller 1: Exit
         dvi:                          Class installer: Enter 21:52:41.921
         dvi:                          Class installer: Exit
         dvi:                          Default installer: Enter 21:52:41.924
         dvi:                          Default installer: Exit
         dvi:                     {DIF_DESTROYPRIVATEDATA - exit(0xe000020e)} 21:52:41.928
         dvi:                Default installer: Exit
         dvi:           {DIF_REGISTER_COINSTALLERS - exit(0x00000000)} 21:52:41.935
         dvi:           {DIF_INSTALLINTERFACES} 21:52:41.938
         dvi:                Using exported function 'CoDeviceInstall' in module 'C:\WINDOWS\system32\WUDFCoInstaller.dll'.
         dvi:                CoInstaller 1 == WUDFCoInstaller.dll
         dvi:                CoInstaller 1: Enter 21:52:41.943
         dvi:                CoInstaller 1: Exit
         dvi:                Class installer: Enter 21:52:41.947
         dvi:                Class installer: Exit
         dvi:                Default installer: Enter 21:52:41.950
         dvi:                Default installer: Exit
         dvi:           {DIF_INSTALLINTERFACES - exit(0x00000000)} 21:52:41.955
         dvi:           {DIF_INSTALLDEVICE} 21:52:41.957
         dvi:                CoInstaller 1: Enter 21:52:41.959
         dvi:                CoInstaller 1: Exit
         dvi:                Class installer: Enter 21:52:42.179
         dvi:                     {Install DEVICE}
         dvi:                          {Writing Device Properties}
         dvi:                               Strong Name=WpdFs.inf:0c0663c081fd6f5b:Basic_Install:10.0.14393.0:wpdbusenum\fs
         dvi:                          {Writing Device Properties - Complete}
         inf:                          AddService=WUDFWpdFs,0x000001fa,WUDFWpdFs_ServiceInstall  (wpdfs.inf line 38)
         dvi:                          Add Service: Modified existing service 'WUDFWpdFs'.
         dvi:                     {Install DEVICE exit (0x00000000)}
         dvi:                     Install Device: Configuring device class. 21:52:42.395
         dvi:                     Install Device: Configuring device class completed. 21:52:42.402
         dvi:                     Install Device: Starting device. 21:52:42.404
         dvi:                     Install Device: Starting device completed. 21:52:43.352
         dvi:                Class installer: Exit
         dvi:                CoInstaller 1: Enter (Post Processing) 21:52:43.368
         dvi:                CoInstaller 1: Exit (Post Processing)
         dvi:           {DIF_INSTALLDEVICE - exit(0x00000000)} 21:52:43.398
         dvi:           {DIF_NEWDEVICEWIZARD_FINISHINSTALL} 21:52:43.400
         dvi:                CoInstaller 1: Enter 21:52:43.401
         dvi:                CoInstaller 1: Exit
         dvi:                Class installer: Enter 21:52:43.403
         dvi:                Class installer: Exit
         dvi:           {DIF_NEWDEVICEWIZARD_FINISHINSTALL - exit(0x00000000)} 21:52:43.613
         ndv:      {Install Device - exit(0x00000000)} 21:52:43.627
         ndv: {Core Device Install - exit(0x00000000)} 21:52:43.628
         dvi: {DIF_DESTROYPRIVATEDATA} 21:52:43.629
         dvi:      CoInstaller 1: Enter 21:52:43.631
         dvi:      CoInstaller 1: Exit
         dvi:      Class installer: Enter 21:52:43.633
         dvi:      Class installer: Exit
         dvi:      Default installer: Enter 21:52:43.635
         dvi:      Default installer: Exit
         dvi: {DIF_DESTROYPRIVATEDATA - exit(0xe000020e)} 21:52:43.638
    <<<  Section end 2016/10/18 21:52:43.652
    <<<  [Exit status: SUCCESS]

    Thanks

    Wren Jacob

    Please let me know also if there is any other way I can find it out if he stole or copied any files or folders from my laptop?

    Sunday, October 23, 2016 5:45 PM