How do I get information about recently connected USB device?

Question

I can catch when usb device is connected with Win32_DeviceChangeEvent

but there are only 3 properties allowed to view

class Win32_DeviceChangeEvent : __ExtrinsicEvent
{
  uint8  SECURITY_DESCRIPTOR[];
  uint64 TIME_CREATED;
  uint16 EventType;
};

But i don't understand how to get all info about this device. Specifically, its port and hub, VirtualHubAdress Name and etc.

public enum EventType
{
    Inserted = 2,
    Removed = 3
}

public static void RegisterUsbDeviceNotification()
{
    var watcher = new ManagementEventWatcher();
    var query = new WqlEventQuery("SELECT * FROM Win32_DeviceChangeEvent WHERE EventType = 2");
    //watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived);
    watcher.EventArrived += (s, e) =>
    {
        //here is im need to get info about this device

        EventType eventType = (EventType)(Convert.ToInt16(e.NewEvent.Properties["EventType"].Value));
    };

    watcher.Query = query;
    watcher.Start();
}

maybe i can do it with using smth like this

[DllImport("UseFull.dll")] 
private IntpPtr GetAllinfo(params);

Answer 1

The Win32_DeviceChangeEvent reports just the type of event that occurred and the Time of the event (uint64, representing 100-nanosecond intervals after January 1, 1601, UTC). No that much useful if you also want to know what arrived or was removed.

I suggest to use instead the WqlEventQuery class, setting its EventClassName to __InstanceOperationEvent.
This system class provides a TargetInstance property the can be cast to a ManagementBaseObject, the full management object that also provides base information on the Device that generated the event.
This information includes (besides the friendly name of the Device) the PNPDeviceID, which can be used to build other queries to further inspect the Device referenced.

The WqlEventQuery's Condition property can be set here to TargetInstance ISA 'Win32_DiskDrive'.
It can be set to any other Win32_ class of interest.

Setup the event listener (local machine):
(The event handler is called DeviceChangedEvent)

var query = new WqlEventQuery() {
    EventClassName = "__InstanceOperationEvent",
    WithinInterval = new TimeSpan(0, 0, 3),
    Condition = @"TargetInstance ISA 'Win32_DiskDrive'"
};

var scope = new ManagementScope("root\\CIMV2");
using (var moWatcher = new ManagementEventWatcher(scope, query))
{
    moWatcher.Options.Timeout = ManagementOptions.InfiniteTimeout;
    moWatcher.EventArrived += new EventArrivedEventHandler(DeviceChangedEvent);
    moWatcher.Start();
}

The event handler receives, in e.NewEvent.Properties["TargetInstance"], the Management Object representing a Win32_DiskDrive class.
See the Docs about the properties directly available here.

The __InstanceOperationEvent derived classes of interest, reported by the e.NewEvent.ClassPath.ClassName, can be:

__InstanceCreationEvent: A new Device arrival has been detected.
__InstanceDeletionEvent: A Device removal has been detected.
__InstanceModificationEvent: An existing device has been modified in some way.

Note that the event is raised in a secondary thread, we need to BeginInvoke() the UI thread to update the UI with the new information.
▶ You should avoid Invoke() here, because it's synchronous: it will block the handler until the method completes. Also, in this context, a dead-lock is not exactly a remote possibility.

See here: Get serial number of USB storage device for a class that provides most of the information available about a device (the information is filtered to show USB devices only, but the filter can be removed).

private void DeviceChangedEvent(object sender, EventArrivedEventArgs e)
{
    using (var moBase = (ManagementBaseObject)e.NewEvent.Properties["TargetInstance"].Value)
    {
        string oInterfaceType = moBase?.Properties["InterfaceType"]?.Value.ToString();
        string devicePNPId = moBase?.Properties["PNPDeviceID"]?.Value.ToString();
        string deviceDescription = moBase?.Properties["Caption"]?.Value.ToString();
        string eventMessage = $"{oInterfaceType}: {deviceDescription} ";

        switch (e.NewEvent.ClassPath.ClassName)
        {
            case "__InstanceDeletionEvent":
                eventMessage += " removed";
                break;
            case "__InstanceCreationEvent":
                eventMessage += "inserted";
                break;
            case "__InstanceModificationEvent":
            default:
                eventMessage += $" {e.NewEvent.ClassPath.ClassName}";
                break;
        }
        BeginInvoke(new Action(() => UpdateUI(eventMessage)));
    }
}

private void UpdateUI(string message)
{
   //Update the UI controls with information provided by the event
}