来自微软官方，写USB小偷脚本是最好不过的了

复制代码 代码如下:

strComputer = "."

Set objWMIService = GetObject("winmgmts:" _

& "{impersonationLevel=impersonate}!" & strComputer & "rootcimv2")

Set colMonitoredEvents = objWMIService. _

ExecNotificationQuery("Select * from Win32_VolumeChangeEvent")

Do

Set objLatestEvent = colMonitoredEvents.NextEvent

Wscript.Echo objLatestEvent.DriveName

Wscript.Echo objLatestEvent.EventType

Wscript.Echo objLatestEvent.Time_Created

Loop