Is there a way to check and see when a device (hardrive/thumbdrive) was disconnected from a computer?

Thanks in advance.

 

You can probably setup auditing on the device but they would have to be formatted with NTFS.

 

hmm....any other takes?

 

couple of ways. you could go through systems logs to see when device manager stopped recognizing it -- i think this reads back to registry somewhere for last read/access time.

you could also theorize a timeframe by looking at the file modified an create timestamps on all the files on the drive. lets say it its a system partition and has some sort of swap or page file. check teh last modified time