有什么方法可以追踪我的笔记本电脑访问过的闪存驱动器列表 - 即它们的品牌名称、容量和/或 USB 闪存驱动器本身的名称或其携带的内容?我的 ubuntu 或 linux 是否会创建已插入的闪存驱动器的历史记录?如果是,此日志还包含哪些其他信息?
答案1
当 USB 设备连接到 Ubuntu Linux 系统时,条目将放置在 中/var/log/dmesg
。您可以使用 查看这些条目dmesg | grep -i usb
,但您不会在那里找到您要查找的详细信息。例如,我在下面包含了该命令在 Ubuntu 系统上的输出。
$ dmesg | grep -i usb
[ 0.329504] usbcore: registered new interface driver usbfs
[ 0.329538] usbcore: registered new interface driver hub
[ 0.329662] usbcore: registered new device driver usb
[ 0.754161] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 0.754430] ehci_hcd 0000:00:1d.7: new USB bus registered, assigned bus number 1
[ 0.784367] ehci_hcd 0000:00:1d.7: USB 2.0 started, EHCI 1.00
[ 0.784776] hub 1-0:1.0: USB hub found
[ 0.784966] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[ 0.785009] uhci_hcd: USB Universal Host Controller Interface driver
[ 0.785282] uhci_hcd 0000:00:1d.0: new USB bus registered, assigned bus number 2
[ 0.785715] hub 2-0:1.0: USB hub found
[ 0.786046] uhci_hcd 0000:00:1d.1: new USB bus registered, assigned bus number 3
[ 0.786496] hub 3-0:1.0: USB hub found
[ 0.786858] uhci_hcd 0000:00:1d.2: new USB bus registered, assigned bus number 4
[ 0.787293] hub 4-0:1.0: USB hub found
[ 0.787563] usbcore: registered new interface driver libusual
[1393889.831389] usbcore: registered new interface driver usblp
[10444614.128059] usb 1-6: new high-speed USB device number 2 using ehci_hcd
[10444614.329012] Initializing USB Mass Storage driver...
[10444614.337558] scsi2 : usb-storage 1-6:1.0
[10444614.337827] usbcore: registered new interface driver usb-storage
[10444614.337834] USB Mass Storage support registered.
$
您还可以在 中找到条目/var/log/syslog
,但您也不会在那里找到那么详细程度的条目。您只会看到类似以下内容,其中显示了几分钟前我插入 Ubuntu 系统的 USB 闪存驱动器相关的条目:
$ grep -i usb /var/log/syslog
Feb 16 09:57:39 Neptune kernel: [10444614.128059] usb 1-6: new high-speed USB device number 2 using ehci_hcd
Feb 16 09:57:39 Neptune mtp-probe: checking bus 1, device 2: "/sys/devices/pci0000:00/0000:00:1d.7/usb1/1-6"
Feb 16 09:57:39 Neptune kernel: [10444614.329012] Initializing USB Mass Storage driver...
Feb 16 09:57:39 Neptune kernel: [10444614.337558] scsi2 : usb-storage 1-6:1.0
Feb 16 09:57:39 Neptune kernel: [10444614.337827] usbcore: registered new interface driver usb-storage
Feb 16 09:57:39 Neptune kernel: [10444614.337834] USB Mass Storage support registered.
您还可以找到kern.log
当 USB 设备连接时插入的日志条目sudo cat /var/log/kern.log | grep -i usb
,但这些条目与您上面看到的类似,但没有您希望看到的详细信息。
$ sudo cat /var/log/kern.log | grep -i usb
Feb 16 09:57:39 Neptune kernel: [10444614.128059] usb 1-6: new high-speed USB device number 2 using ehci_hcd
Feb 16 09:57:39 Neptune kernel: [10444614.329012] Initializing USB Mass Storage driver...
Feb 16 09:57:39 Neptune kernel: [10444614.337558] scsi2 : usb-storage 1-6:1.0
Feb 16 09:57:39 Neptune kernel: [10444614.337827] usbcore: registered new interface driver usb-storage
Feb 16 09:57:39 Neptune kernel: [10444614.337834] USB Mass Storage support registered.
关于如何获取有关将 USB 设备连接到 Ubuntu 系统的信息,以前在姊妹 Stack Exchange 网站上也曾提出过类似的问题询问 Ubuntu.例如:
在Unix 和 LinuxStack Exchange 网站回应监控 USB 闪存盘的历史记录有人建议编写一个脚本来记录更多细节,并提供了脚本中应包含的内容的详细信息,但正如 Ramhound 所说,这不会为您提供有关过去连接的信息,因为系统日志文件中默认创建的条目没有那么详细。