Download USBDeview for Windows PC (2026)

Yes, USBDeview is safe. It has been developed by Nir Sofer at NirSoft, a well-known publisher of free Windows utilities since 2001. The tool has been reviewed and recommended by major tech publications including CNET, Softpedia, and FileHorse, all of which mark it as clean and free of malware.

The 64-bit version (usbdeview-x64.zip) is only about 104 KB, and the 32-bit version is around 115 KB. Files this small are easy for antivirus software to scan completely. Some antivirus programs may flag NirSoft tools with a generic “potentially unwanted program” warning because USBDeview can disable and uninstall device drivers. This is a false positive. The tool does not modify your system without your explicit action, and NirSoft provides SHA-256 hash values on the official download page so you can verify file integrity after downloading.

• Download only from the official NirSoft page at nirsoft.net/utils/usb_devices_view.html or from our download section
• Verify the ZIP file hash against the SHA-256 value listed on the NirSoft page
• If your antivirus flags it, add an exception for USBDeview.exe after confirming the hash

Pro tip: NirSoft tools are widely used in corporate IT departments and digital forensics labs, which speaks to their trustworthiness. If your workplace security policy blocks the download, ask your IT admin to whitelist the NirSoft domain.

For more on what USBDeview does and why it needs the access it requests, see our features overview.

The official source for USBDeview is the NirSoft website at nirsoft.net. Nir Sofer publishes all his utilities there, and the USBDeview page includes both the 32-bit and 64-bit ZIP archives, SHA-256 hashes, and the full changelog going back to the original release.

A common mistake is downloading USBDeview from third-party “download portal” sites that wrap the original ZIP inside their own installer. These wrapper installers sometimes bundle adware or browser toolbars. The genuine USBDeview download is a plain ZIP file containing just the executable (USBDeview.exe), a readme file, and an optional configuration file. There is no installer, no setup wizard, and no bundled software. If a site gives you an .exe installer instead of a ZIP, you are not downloading the real thing.

• Go to nirsoft.net/utils/usb_devices_view.html
• Scroll to the “Feedback” section near the bottom of the page
• Click “Download USBDeview” (32-bit) or “Download USBDeview for x64 systems” (64-bit)
• Extract the ZIP to any folder and run USBDeview.exe directly

Pro tip: You can also download USBDeview via Scoop (the Windows package manager) by running scoop install usbdeview from your terminal. This pulls the official binary and keeps it updated automatically.

We keep verified links in our download section so you can get the correct version quickly.

This is a false positive. Antivirus software sometimes flags USBDeview because the tool can disable, disconnect, and uninstall USB device drivers, which are actions that could be misused by malicious software. Many NirSoft utilities trigger these generic heuristic detections for the same reason.

The detection labels you might see include “HackTool,” “RiskTool,” or “PUA” (Potentially Unwanted Application). These are not virus signatures. They are behavioral flags based on what the software can do, not on any actual malicious code inside the binary. NirSoft has addressed this directly on their website, explaining that they have contacted antivirus vendors about false positives multiple times over the years. The problem persists because heuristic scanning casts a wide net.

1. Download USBDeview from the official NirSoft page or our download section
2. Compare the SHA-256 hash of the downloaded ZIP against the hash listed on the NirSoft page
3. If the hashes match, add an exclusion in your antivirus for the folder containing USBDeview.exe
4. In Windows Defender: Settings > Virus & threat protection > Exclusions > Add exclusion > Folder

Pro tip: Upload USBDeview.exe to VirusTotal.com before running it. You will see that the vast majority of engines (typically 60+ out of 70) mark it as clean, with only a handful of heuristic flags from less well-known engines.

Check our Getting Started guide for the full setup walkthrough including antivirus configuration.

Yes, USBDeview v3.07 works on Windows 11 without any issues. NirSoft officially lists support for Windows 2000 through Windows 11, covering both 32-bit and 64-bit editions. The 64-bit build (usbdeview-x64.zip) is the recommended version for all modern Windows 11 systems.

USBDeview reads USB device information directly from the Windows registry (HKLM\SYSTEM\CurrentControlSet\Enum\USB and USBSTOR keys), and this registry structure has remained consistent across Windows versions. Some users on the Eleven Forum have reported that the “Last Plug/Unplug Date” column occasionally shows the most recent reboot time instead of the actual event timestamp on certain Windows 11 builds. This is a Windows registry behavior, not a USBDeview bug. The tool reads whatever timestamp Windows records.

• Download the 64-bit version for Windows 11 (all current Windows 11 builds are 64-bit)
• Right-click USBDeview.exe and select “Run as administrator” for full functionality
• If you need to disable or uninstall devices, admin rights are required on Windows 11

Pro tip: Windows 11 introduced stricter driver signing requirements. If USBDeview shows a device as “disabled” but you cannot re-enable it, the device driver may have been blocked by Windows 11 Secure Boot. Check Device Manager for driver signing errors.

See the full list of supported platforms in our system requirements section.

USBDeview has almost no system requirements. It runs on any Windows PC from Windows 2000 onwards, needs less than 1 MB of RAM during operation, and the executable itself is under 200 KB. There is no GPU requirement, no .NET dependency, and no runtime library needed.

The tool is entirely portable. You do not install it. You extract a ZIP file containing USBDeview.exe (about 115 KB for 32-bit, 104 KB for 64-bit) and run it directly. It works from a USB flash drive, a network share, or any local folder. The only real requirement is administrator privileges if you want to use the disable, enable, disconnect, or uninstall functions. Read-only viewing of USB device history works without admin rights.

• OS: Windows 2000, XP, Vista, 7, 8, 8.1, 10, 11 (32-bit and 64-bit), plus Server 2003/2008/2012/2016/2019/2022
• CPU: Any x86 or x64 processor
• RAM: Under 1 MB in use at runtime
• Disk: Under 200 KB (portable, no installation)
• Admin rights: Required for device management actions, optional for viewing

Pro tip: If you want vendor and product name lookups (instead of just VID/PID codes), download the usb.ids file from the Linux USB ID Repository and place it in the same folder as USBDeview.exe. This adds about 600 KB but gives you human-readable manufacturer and product names for thousands of USB devices.

For a detailed breakdown, visit our system requirements table.

Use the 64-bit version if you are running a 64-bit edition of Windows, which includes all Windows 11 systems and most Windows 10 installations from the last several years. The 32-bit version is only needed for older 32-bit Windows installations.

NirSoft provides two separate ZIP downloads: usbdeview.zip (32-bit, about 115 KB) and usbdeview-x64.zip (64-bit, about 104 KB). The 64-bit version is required to properly disable, enable, and uninstall USB device drivers on 64-bit Windows. The 32-bit version will run on 64-bit Windows through WOW64 compatibility, but device management operations like disable and uninstall will not work correctly because they need to interact with 64-bit system drivers directly.

1. Press Win + I to open Settings
2. Go to System > About
3. Under “System type,” check if it says “64-bit operating system” or “32-bit operating system”
4. Download the matching version from our download section

Pro tip: If you carry USBDeview on a USB stick for troubleshooting different machines, put both versions in separate folders on the same drive. That way you always have the right one regardless of which system you plug into.

Both versions are available in our download section with direct links.

Yes, USBDeview is 100% free. There is no paid version, no premium tier, no subscription, and no feature locked behind a paywall. Nir Sofer has published USBDeview as freeware since its first release in 2006, and every version through v3.07 has remained free.

NirSoft makes money through donations and advertising on their website, not through software licensing. The USBDeview license allows free use for personal and commercial purposes. You can use it at home, in a corporate environment, or in a forensics lab without paying anything. There is no EULA requiring registration, no trial period, and no nag screens. The tool does not phone home or collect any telemetry data.

• No paid version exists. Every feature is available for free
• Commercial use is permitted without a separate license
• No registration, no account creation, no email required
• No ads, no bundled software, no in-app purchases

Pro tip: If you find USBDeview useful, NirSoft accepts donations through their website. Nir Sofer maintains over 200 free utilities, and donations help keep them updated and available.

Download the full-featured tool for free from our download section.

Yes, USBDeview is free for both personal and commercial use. There are no licensing restrictions that prevent deployment in a business, school, government, or enterprise environment. Many IT departments already use it for USB device auditing and troubleshooting.

For enterprise deployment, USBDeview supports several features that make large-scale use practical. The command-line interface lets you script device management tasks across multiple machines. The /remote flag allows you to view USB device history on remote computers over the network, provided you have admin access. You can export device lists to CSV, HTML, XML, or tab-delimited text for import into asset management or SIEM tools. Sysadmins commonly use USBDeview to audit which USB storage devices have been connected to workstations, which is a common compliance requirement for PCI-DSS, HIPAA, and ISO 27001.

• Deploy via SCCM, Intune, or any software distribution tool by copying the ZIP to a shared folder
• Use USBDeview.exe /scomma "\\server\share\%COMPUTERNAME%-usb.csv" in a login script to collect USB inventories
• Use USBDeview.exe /remote \\workstation01 to view USB history on a remote machine

Pro tip: For compliance audits, schedule a daily task that runs USBDeview.exe /scomma to export connected USB device data to a central share. This gives you a timestamped log of USB activity across your fleet without installing any agent software.

Learn more about advanced features in our features section.

USBDeview does not have an installer. You download a ZIP file, extract it, and run the executable. The entire process takes under 30 seconds. The ZIP is about 104 KB for the 64-bit version, so even on slow connections, the download finishes almost instantly.

There is nothing to configure before first use. USBDeview reads your system’s USB device registry entries and displays them in a sortable table the moment you launch it. However, for full functionality (disabling, enabling, and uninstalling devices), you need to run USBDeview.exe as administrator. On Windows 10 and 11, right-click the executable and select “Run as administrator,” or set it permanently in the file’s Properties > Compatibility tab.

1. Visit our download section and grab the 64-bit ZIP (for Windows 10/11) or 32-bit ZIP (for older systems)
2. Right-click the downloaded ZIP and select “Extract All” to a folder of your choice, for example C:\Tools\USBDeview
3. Open the extracted folder and right-click USBDeview.exe, then select “Run as administrator”
4. The main window appears showing all current and past USB devices on your system
5. Optionally, download usb.ids from the Linux USB ID Repository and place it in the same folder for human-readable vendor names

Pro tip: Pin USBDeview to your taskbar or create a shortcut with “Run as administrator” enabled in its properties. This saves you from right-clicking every time you need to manage USB devices.

Our Getting Started guide walks through first-time setup and configuration in full detail.

USBDeview is fully portable. There is no installer, no setup wizard, and no Windows registry entries created by the tool itself. You can run it directly from a USB flash drive, an external hard drive, or a network share without leaving any footprint on the host machine.

The entire application consists of a single executable file (USBDeview.exe) plus an optional readme and configuration file. When you run USBDeview, it reads system information from the Windows registry (HKLM\SYSTEM hive) but does not write any of its own data to the registry. If you save configuration settings (like column widths or sort order), these are stored in a .cfg file in the same directory as the executable, not in the system registry. This makes USBDeview ideal for IT technicians who carry a toolkit on a USB drive and plug it into different machines throughout the day.

• No installation required at any point
• No files written to Program Files, AppData, or the Windows registry
• Configuration stored in a .cfg file alongside the executable
• Runs from USB drives, network shares, or any local folder
• Does not require .NET Framework, Java, or any runtime dependency

Pro tip: Create a “USB Toolkit” folder on a flash drive with both the 32-bit and 64-bit versions of USBDeview, plus the usb.ids file. This way, you are ready to diagnose USB problems on any Windows machine you encounter, regardless of its architecture.

Get your portable copy from our download section.

If USBDeview is not showing all devices, the most likely cause is that you are not running it as administrator. Without admin rights, USBDeview can only read a limited subset of the USB device registry entries, which means some previously connected devices may be hidden from view.

Another common reason is the display filter. USBDeview has several built-in filters in the Options menu that can hide certain device types. By default, it may hide devices that have no serial number, or you might have accidentally enabled “Display Only Connected Devices” (Options > Display Disconnected Devices must be checked). On Windows 10 and 11, the USB device registry entries live under HKLM\SYSTEM\CurrentControlSet\Enum\USB and HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR, and USBDeview reads both. If entries were manually cleaned from the registry (by another cleanup tool or Group Policy), USBDeview cannot show what no longer exists.

1. Close USBDeview and relaunch it by right-clicking and selecting “Run as administrator”
2. Go to Options > make sure “Display Disconnected Devices” is checked
3. Go to Options > clear any active “Advanced Filters” (Ctrl+F9 to open the filter dialog)
4. Press F5 to refresh the device list
5. If devices are still missing, check if another cleanup tool (like Device Cleanup Tool) has removed the old registry entries

Pro tip: Use the View > Choose Columns menu to add the “Device Mfg” and “Driver Description” columns. Sometimes devices show up with blank display names but have valid manufacturer info that helps identify them.

For more on initial configuration, see our Getting Started guide.

USBDeview lets you remove old USB device entries directly from the Windows registry. This is useful for cleaning up devices you no longer own, fixing “USB device not recognized” errors caused by stale driver data, and reducing clutter in Device Manager.

When you uninstall a device entry through USBDeview, it removes the device’s registry keys from HKLM\SYSTEM\CurrentControlSet\Enum\USB and the associated driver files. This is a more thorough cleanup than simply disconnecting or disabling a device. On Windows 10 and 11, these old entries accumulate over time as you plug in keyboards, mice, flash drives, phones, and other peripherals. It is not uncommon for a system to have 50-100+ old USB entries after a few years of use.

1. Run USBDeview as administrator (right-click > Run as administrator)
2. Gray-highlighted rows represent disconnected (old) devices; green rows are currently connected
3. Select the old entries you want to remove. Use Ctrl+click to select multiple entries, or Ctrl+A to select all
4. Right-click the selection and choose “Uninstall Selected Devices” or press the Delete key
5. Confirm the prompt. USBDeview removes the registry entries for those devices
6. Restart your computer if you are cleaning up entries to fix a “USB device not recognized” error

Pro tip: Before doing a bulk cleanup, export your full device list to CSV first (File > Save Selected Items or Ctrl+S). This gives you a backup record of every device that was ever connected, including serial numbers and timestamps, which can be useful for auditing or if you need to troubleshoot later.

Learn about all device management features in our features section.

This is a known issue reported by some users on Reddit and tech forums. When USBDeview runs in the background monitoring USB device activity, it can occasionally interfere with keyboard input, causing keys to appear “stuck” or repeat unexpectedly.

The root cause appears to be related to how USBDeview polls USB device status changes. When the tool detects a device connect or disconnect event, it briefly accesses the USB driver stack, which on some hardware configurations can delay keyboard input processing. This has been observed more frequently on systems with many USB devices connected simultaneously, and on laptops with USB hubs built into docking stations. The issue was discussed in r/techsupport where users confirmed it resolved after closing USBDeview.

1. Do not leave USBDeview running in the background or system tray unless you need active monitoring
2. If you need it running, go to Options > uncheck “Auto Refresh” to stop the periodic USB bus polling
3. Close USBDeview when you are done managing USB devices rather than minimizing it
4. Update to USBDeview v3.07, which includes various stability improvements over older versions

Pro tip: If you need persistent USB monitoring, consider using USBDeview’s command-line export on a scheduled task instead of keeping the GUI open. Run USBDeview.exe /scomma "C:\Logs\usb-log.csv" on a 5-minute schedule via Task Scheduler for the same data without the background polling.

Check our Getting Started guide for recommended settings and configuration.

USBDeview has a built-in speed test that measures sequential read and write speeds of USB flash drives. The test requires at least 100 MB of free space on the drive and writes a temporary test file to measure throughput.

The speed test results give you a practical measurement of your drive’s real-world performance. This is simpler than using dedicated benchmarking tools like CrystalDiskMark when you just want a quick read/write figure. The test writes data sequentially and then reads it back, reporting both speeds in MB/s. Results are added to the device’s entry in USBDeview’s table under the “Speed Test Read” and “Speed Test Write” columns, so you can compare speeds across multiple drives without needing to run each test separately.

1. Run USBDeview as administrator
2. Plug in the USB flash drive and wait for it to appear in the device list (green highlight = connected)
3. Right-click the flash drive entry and select “Speed Test” from the context menu
4. Wait for the test to complete. It takes about 30-60 seconds depending on drive speed
5. Read and write speeds appear in the Speed Test Read and Speed Test Write columns

Pro tip: Make sure no other program is reading or writing to the USB drive during the test. Close File Explorer windows pointing to the drive, stop any sync software, and eject/reconnect the drive before testing for the most accurate results. Also, USB 3.0 drives must be plugged into a USB 3.0 port (usually blue) to show their real speed.

Our features section covers the speed test and other USBDeview capabilities.

USBDeview can export the full USB device list to CSV, HTML, XML, tab-delimited text, or plain text format. This is useful for compliance audits, forensic documentation, and IT asset tracking.

The export includes all visible columns for every device in the list: device name, description, type, serial number, VendorID, ProductID, first install date, last plug/unplug date, and every other field USBDeview tracks. You can customize which columns appear in the export by first adjusting the column visibility in View > Choose Columns before exporting. The command-line export method is particularly useful for automation: running USBDeview.exe /scomma "output.csv" generates a CSV file without even opening the GUI.

1. Open USBDeview as administrator for the most complete device list
2. To export via GUI: go to File > Save Selected Items (Ctrl+S) or View > HTML Report for a formatted report
3. Choose your format: .csv for spreadsheets, .html for readable reports, .xml for data processing
4. To export via command line: USBDeview.exe /scomma "C:\Reports\usb-devices.csv"
5. Other CLI export options: /shtml for HTML, /sxml for XML, /stab for tab-delimited

Pro tip: For forensic reports, use /shtml output because it preserves the table formatting and is easier to include in incident documentation. Add /sort "Last Plug/Unplug Date" to sort by most recent USB activity.

For all command-line options, see our Getting Started guide.

Yes, USBDeview can connect to and display USB device data from remote Windows computers on your network. This requires administrator access to the remote machine and the “Remote Registry” service running on the target computer.

The remote feature reads the same HKLM\SYSTEM registry keys on the remote machine that it reads locally. You can view connected devices, disconnected device history, serial numbers, and connection timestamps. However, you cannot perform actions like disable, enable, or speed test on remote devices. The remote view is read-only. This feature is primarily used by IT administrators who need to audit USB device usage across workstations without physically visiting each machine or installing any software on the remote end.

1. Make sure you have admin credentials for the remote machine
2. Verify the “Remote Registry” Windows service is running on the remote PC (it is disabled by default on Windows 10/11)
3. In USBDeview, go to Options > Advanced Options (F9) or use File > “Connect to Remote Computer”
4. Enter the remote computer name or IP address and click OK
5. USBDeview will load the USB device history from the remote machine

Pro tip: For batch auditing, use the command line: USBDeview.exe /remote \\workstation01 /scomma "\\server\audit\ws01-usb.csv". Script this for every workstation on your network to generate USB device reports for the entire fleet in one pass.

Read more about remote management in our features section.

USBDeview does not have a built-in auto-update feature. To update, you download the latest ZIP from NirSoft and replace the old executable. The current latest version is v3.07.

Because USBDeview is portable and writes no registry entries, updating is straightforward: download the new ZIP, extract it, and overwrite the old USBDeview.exe. Your custom settings are stored in a .cfg file in the same directory, and the new version will pick up your existing configuration automatically. NirSoft does not provide release notifications, so you need to check the download page manually or follow NirSoft on Twitter for update announcements. The changelog on the official page lists every change since version 1.00.

1. Check your current version: open USBDeview, go to Help > About, note the version number
2. Visit our download section to see the latest available version
3. Download the new ZIP (64-bit or 32-bit matching your current setup)
4. Extract the new USBDeview.exe to the same folder where your old copy lives, overwriting the old file
5. Relaunch USBDeview. Your settings (.cfg file) carry over automatically

Pro tip: If you installed USBDeview via Scoop, updating is even simpler: run scoop update usbdeview from your terminal, and it handles the download and replacement for you.

Our download section always links to the latest version.

They serve different purposes. USBDeview is better for managing USB devices and viewing connection history. USB Device Tree Viewer (by Uwe Sieber) is better for diagnosing USB hardware topology and connection problems.

USBDeview shows a flat list of every USB device that has ever been connected to your machine, with columns for serial number, VendorID, ProductID, install date, last plug/unplug date, and more. You can disable, enable, uninstall, and speed-test devices directly from the interface. USB Device Tree Viewer, on the other hand, shows the physical USB topology as a tree: which controllers are on your motherboard, which hubs are connected to each controller, and which devices are on each hub port. It displays USB descriptor data, link speeds (USB 2.0/3.0/3.1), and companion port assignments. USB Device Tree Viewer v4.6.4 also supports ARM64 Windows.

• Choose USBDeview when: you need to clean up old device entries, export USB history for audits, disable/enable devices, test flash drive speeds, or monitor USB connections on remote machines
• Choose USB Device Tree Viewer when: you need to see which physical port a device is on, diagnose speed negotiation issues (device running at USB 2.0 on a 3.0 port), or inspect USB descriptors for development
• Use both: many IT professionals keep both tools on their USB toolkit. They provide complementary information with no overlap in functionality

Pro tip: If a USB device is “not recognized,” start with USBDeview to uninstall the old entry and force driver reinstallation. If the problem persists, use USB Device Tree Viewer to check whether the port itself is reporting errors or if the device is enumerating at the wrong speed.

See everything USBDeview can do in our features section.

USBDeview has a full command-line interface that supports device management, data export, and automation without opening the GUI. This makes it valuable for scripting, scheduled tasks, and integration with IT management workflows.

The command-line syntax follows the pattern USBDeview.exe /action "DeviceString", where the device string can be the Instance ID (from the GUI’s “Instance ID” column), a partial device description, or a VID/PID pair. All management actions (disable, enable, uninstall, disconnect) require administrator privileges. Export commands work without admin rights but will only capture devices visible to the current user context.

• /disable "DeviceName" – Disable a USB device by name or Instance ID
• /enable "DeviceName" – Re-enable a disabled device
• /disable_enable "DeviceName" – Toggle a device off then on (simulates unplug/replug)
• /uninstall "DeviceName" – Remove the device entry and its drivers
• /stop "DeviceName" – Safely disconnect (eject) a USB device
• /disable_by_pid "VID;PID" – Disable all devices matching a specific Vendor/Product ID pair
• /scomma "file.csv" – Export all devices to CSV
• /shtml "file.html" – Export to HTML report
• /sort "ColumnName" – Sort output by a specific column
• /RunAsAdmin – Request elevation automatically

Pro tip: Combine switches for powerful one-liners. For example, USBDeview.exe /remote \\pc01 /sort "Last Plug/Unplug Date" /scomma "audit.csv" /RunAsAdmin pulls a sorted USB history from a remote machine and saves it to CSV in a single command.

Our Getting Started guide includes more command-line examples and scripting patterns.

Yes, USBDeview is a commonly used tool in digital forensics for examining USB device connection history on Windows machines. It reads the same registry keys (USBSTOR and USB under HKLM\SYSTEM) that forensic examiners typically analyze manually.

For each USB device that was ever connected, USBDeview records the device name, serial number, VendorID, ProductID, first installation date, last plug/unplug date, device class, and driver information. In a forensic context, this data can establish which USB storage devices were connected to a suspect’s computer, when they were first used, and when they were last plugged in. The serial number field is particularly valuable because it uniquely identifies a specific physical device across different computers. USBDeview can also load registry hives from offline Windows installations using the /regfile command-line switch, which is essential when analyzing disk images without booting the original OS.

• Export the full device history with timestamps: USBDeview.exe /scomma "evidence.csv"
• Load offline registry hives from a mounted disk image: USBDeview.exe /regfile "E:\Windows\System32\config\SYSTEM"
• Cross-reference serial numbers across multiple machines to track a specific USB device
• The “Created Date” column shows when Windows first encountered the device
• Pair with registry analysis tools for chain-of-custody documentation

Pro tip: For proper forensic work, always run USBDeview on a forensic workstation against a mounted image, never directly on the suspect machine. Use the /regfile option with offline hives to preserve evidence integrity. The GitHub project “Clean-Usbdeview” by bishoppebbles provides a PowerShell script that cleans and formats USBDeview TSV output specifically for forensic reports.

See the full list of data fields USBDeview captures in our features section.