{"id":67973,"date":"2006-02-13T04:51:00","date_gmt":"2006-02-13T04:51:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2006\/02\/13\/how-can-i-determine-when-a-removable-drive-gets-connected\/"},"modified":"2006-02-13T04:51:00","modified_gmt":"2006-02-13T04:51:00","slug":"how-can-i-determine-when-a-removable-drive-gets-connected","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/how-can-i-determine-when-a-removable-drive-gets-connected\/","title":{"rendered":"How Can I Determine When a Removable Drive Gets Connected?"},"content":{"rendered":"

\"Hey, \n

Hey, Scripting Guy! How can I determine when a USB flash drive gets connected?

— PS<\/P>\"Spacer\"\"Hey,\"Script<\/A> \n

Hey, PS. OK, we admit it: the Scripting Guys are lazy. (Especially on a Friday, which is the day when we have to write our Monday column.) There might be a way to monitor specifically for the insertion of a USB flash drive; however, we couldn\u2019t find one, at least not right away. Admittedly, we probably could<\/I> have looked a bit harder; however, we decided instead to write a script that tells you when any<\/I> removable drive gets connected (or disconnected) from a machine. We like to think that this way we\u2019re providing you with additional value and flexibility.<\/P>\n

Hey, we didn\u2019t say we really were<\/I> providing you with additional value and flexibility. We just like to think that we are.<\/P>\n

Actually, this is kind of a handy little script. And it has the added benefit of running on any version of Windows. (Originally we toyed with the notion of using the Win32_VolumeChangeEvent class to accomplish this task, but that particular WMI class is found only on Windows XP or greater.)<\/P>\n

Here\u2019s what the code looks like:<\/P>

strComputer = “.”\nSet objWMIService = GetObject(“winmgmts:\\\\” & strComputer & “\\root\\cimv2”)<\/p>\n
Set colEvents = objWMIService.ExecNotificationQuery _\n    (“Select * From __InstanceOperationEvent Within 10 Where ” _\n        & “TargetInstance isa ‘Win32_LogicalDisk'”)<\/p>\n
Do While True\n    Set objEvent = colEvents.NextEvent\n    If objEvent.TargetInstance.DriveType = 2 Then \n        Select Case objEvent.Path_.Class\n            Case “__InstanceCreationEvent”\n                Wscript.Echo “Drive ” & objEvent.TargetInstance.DeviceId & _\n                    ” has been added.”\n            Case “__InstanceDeletionEvent”\n                Wscript.Echo “Drive ” & objEvent.TargetInstance.DeviceId & _\n                    ” has been removed.”\n        End Select\n    End If\nLoop\n<\/PRE>\n
And yes, this is<\/I> similar to the screensaver monitoring script<\/B><\/A> we showed you the other day. We like to think that reusing the same script day-after-day provides you with additional value and flexibility. (Although mostly it just ensures that we don\u2019t have to work very hard.) <\/P>\n
This script starts off by connecting to the WMI service on the local computer. We then issue this query:<\/P>
Set colEvents = objWMIService.ExecNotificationQuery _\n    (“Select * From __InstanceOperationEvent Within 10 Where ” _\n        & “TargetInstance ISA ‘Win32_LogicalDisk'”)\n<\/PRE>\n
What\u2019s going on here? Well, here we\u2019re using the ExecNotificationQuery<\/B> method to subscribe to a particular set of WMI events. What WMI events? (Boy, you have a lot of questions, don\u2019t you?) In this case we want to be notified any time changes are made to an instance of the Win32_LogicalDisk class; as you\u2019ll see momentarily, those changes will include creating a new instance of the class (i.e., adding a removable drive) and deleting an existing instance of the class (i.e., removing a removable drive). The Within 10<\/B> simply means we\u2019re going to check every 10 seconds to see whether any of the Win32_LogicalDisk instances have changed. <\/P>\n
And yes, that means if you insert a removable drive and then remove it 6 seconds later we might never know about it. If that\u2019s a problem, then change 10 to a smaller number. You can also change 10 to a higher number. For example, change 10 to 60 and your check will occur every 60 seconds rather than every 10 seconds.<\/P>\n
See? We even built added value and flexibility into the code itself!<\/P>\n
After that we set up one of those crazy Do loops designed to run forever:<\/P>
Do While True\n<\/PRE>\n
And then we encounter this line of code:<\/P>
Set objEvent = colEvents.NextEvent\n<\/PRE>\n
As we noted in the previous column<\/B><\/A>, this line of code causes the script to \u201cblock;\u201d that simply means the script will pause on this line until there\u2019s a change to the Win32_LogicalDisk class. That change (which could be the creation of a new instance or the deletion\/modification of an existing instance) will then cause the script to execute the remaining lines of code in the Do loop.<\/P>\n
Good question: what exactly do<\/I> those remaining lines of code do? Well, first we check to see if the drive that generated the event happens to be a removable drive (a DriveType<\/B> of 2 as far as WMI is concerned):<\/P>
If objEvent.TargetInstance.DriveType = 2 Then\n<\/PRE>\n
If the DriveType is not<\/I> 2, then we just loop around and wait for the next event to occur. If the DriveType is<\/I> 2 then we use a Select Case block to determine which type of event occurred. We can do that by determining the Class<\/B> of the event:<\/P>
Select Case objEvent.Path_.Class\n<\/PRE>\n
Why do we do that? Two reasons: First, we aren\u2019t interested in any changes to existing instances. For example, we don\u2019t care if the amount of free drive space has changed on drive C. If you look at the Select Case code you\u2019ll notice we don\u2019t bother checking for the __InstanceModificationEvent. Why not? Because we don\u2019t care about the __InstanceModificationEvent (the event type generated when an existing instance is modified in some way).<\/P>\n
Second, we want to draw a distinction between the __InstanceCreationEvent (which tells us a new drive has been created) and the __InstanceDeletionEvent (which tells us an existing drive has been deleted). By identifying the event type we can echo back a different (and appropriate) message. For example, here\u2019s the code that determines whether a new drive was created and, if so, echoes back a message to that effect:<\/P>
Case “__InstanceCreationEvent”\n    Wscript.Echo “Drive ” & objEvent.TargetInstance.DeviceId & _\n        ” has been added.”\n<\/PRE>\n
And here\u2019s the code that tells us whether an existing drive has been deleted:<\/P>
Case “__InstanceDeletionEvent”\n    Wscript.Echo “Drive ” & objEvent.TargetInstance.DeviceId & _\n        ” has been removed.”\n<\/PRE>\n
Once we\u2019ve echoed the appropriate message we loop around and wait for the next event to occur. By default the script will run forever, or at least until you terminate the script process. Whichever comes first.<\/P>\n
Like we said, it\u2019s not exactly<\/I> what you asked for, but it should do the job. Oh, and don\u2019t forget the additional value and flexibility. That should more than make up for the fact that we didn\u2019t really answer your question. (We like to think we answered a<\/I> question. Just not your question.)<\/P><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! How can I determine when a USB flash drive gets connected?— PS Hey, PS. OK, we admit it: the Scripting Guys are lazy. (Especially on a Friday, which is the day when we have to write our Monday column.) There might be a way to monitor specifically for the insertion of a […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[216,42,3,4,12,5,6],"class_list":["post-67973","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-disk-drives-and-volumes","tag-events-and-monitoring","tag-scripting-guy","tag-scripting-techniques","tag-storage","tag-vbscript","tag-wmi"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! How can I determine when a USB flash drive gets connected?— PS Hey, PS. OK, we admit it: the Scripting Guys are lazy. (Especially on a Friday, which is the day when we have to write our Monday column.) There might be a way to monitor specifically for the insertion of a […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/67973","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=67973"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/67973\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=67973"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=67973"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=67973"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}