How do I get information about recently connected USB device?

The Win32_DeviceChangeEvent reports just the type of event that occurred and the Time of the event (uint64, representing 100-nanosecond intervals after January 1, 1601, UTC). No that much useful if you also want to know what arrived or was removed.

I suggest to use instead the WqlEventQuery class, setting its EventClassName to __InstanceOperationEvent.
This system class provides a TargetInstance property the can be cast to a ManagementBaseObject, the full management object that also provides base information on the Device that generated the event.
This information includes (besides the friendly name of the Device) the PNPDeviceID, which can be used to build other queries to further inspect the Device referenced.

The WqlEventQuery‘s Condition property can be set here to TargetInstance ISA 'Win32_DiskDrive'.
It can be set to any other Win32_ class of interest.

Setup the event listener (local machine):
(The event handler is called DeviceChangedEvent)

var query = new WqlEventQuery() {
    EventClassName = "__InstanceOperationEvent",
    WithinInterval = new TimeSpan(0, 0, 3),
    Condition = @"TargetInstance ISA 'Win32_DiskDrive'"
};

var scope = new ManagementScope("root\\CIMV2");
using (var moWatcher = new ManagementEventWatcher(scope, query))
{
    moWatcher.Options.Timeout = ManagementOptions.InfiniteTimeout;
    moWatcher.EventArrived += new EventArrivedEventHandler(DeviceChangedEvent);
    moWatcher.Start();
}

The event handler receives, in e.NewEvent.Properties["TargetInstance"], the Management Object representing a Win32_DiskDrive class.
See the Docs about the properties directly available here.

The __InstanceOperationEvent derived classes of interest, reported by the e.NewEvent.ClassPath.ClassName, can be:

__InstanceCreationEvent: A new Device arrival has been detected.
__InstanceDeletionEvent: A Device removal has been detected.
__InstanceModificationEvent: An existing device has been modified in some way.

Note that the event is raised in a secondary thread, we need to BeginInvoke() the UI thread to update the UI with the new information.
▶ You should avoid Invoke() here, because it’s synchronous: it will block the handler until the method completes. Also, in this context, a dead-lock is not exactly a remote possibility.

See here: Get serial number of USB storage device for a class that provides most of the information available about a device (the information is filtered to show USB devices only, but the filter can be removed).

private void DeviceChangedEvent(object sender, EventArrivedEventArgs e)
{
    using (var moBase = (ManagementBaseObject)e.NewEvent.Properties["TargetInstance"].Value)
    {
        string oInterfaceType = moBase?.Properties["InterfaceType"]?.Value.ToString();
        string devicePNPId = moBase?.Properties["PNPDeviceID"]?.Value.ToString();
        string deviceDescription = moBase?.Properties["Caption"]?.Value.ToString();
        string eventMessage = $"{oInterfaceType}: {deviceDescription} ";

        switch (e.NewEvent.ClassPath.ClassName)
        {
            case "__InstanceDeletionEvent":
                eventMessage += " removed";
                BeginInvoke(new Action(() => UpdateUI(eventMessage)));
                break;
            case "__InstanceCreationEvent":
                eventMessage += "inserted";
                BeginInvoke(new Action(() => UpdateUI(eventMessage)));
                break;
            case "__InstanceModificationEvent":
            default:
                Console.WriteLine(e.NewEvent.ClassPath.ClassName);
                break;
        }
    }
}

private void UpdateUI(string message)
{
   //Update the UI controls with information provided by the event
}

Leave a Comment