A device detection system for detecting use of removable media such as flash drives, portable storage, disks, and digital cameras in computers. From each monitored client, messages are sent by a client device detection application to a server application running on a central or administrator computer or node. The messages include relevant information for the client computer such as IP address, computer name, and user name along with the device. Generally, a message will be sent when the device is first detected such as when it is attached to the client computer or connected to a port and when the device is later changed such as when the device is removed, and detection is achieved by a function intercepting event messages in the operating system environment combined with a drive detector. The messages are stored in system memory so as to log the attachment or use of removable media.