Declare Function GetDriveType Lib "Kernel32" _
                 Alias "GetDriveTypeA" ( _
                 ByVal nDrive As String) As Integer
 
    Enum DeviceType
        Unknown = 0
        Not_Root_Directory = 1
        RemovableDisk = 2
        LocalDisk = 3
        NetworkDrive = 4
        CompactDisc = 5
        RAMDisk = 6
    End Enum
 
    Enum EventType
        ConfigurationChanged = 1
        DeviceArrival = 2
        DeviceRemoval = 3
        Docking = 4
    End Enum
 
    Structure DeviceEventInfo
        Dim deviceType As devicetype
        Dim driveName As String
        Dim eventType As eventtype
        Dim fireTime As DateTime
        Dim TIME_CREATED As UInt64
        Dim SECURITY_DESCRIPTOR As Byte
    End Structure
 
    Dim WithEvents w As ManagementEventWatcher
    Dim q As WqlEventQuery
 
    Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As _
      System.EventArgs) Handles MyBase.Load
        q = New WqlEventQuery("Select * from Win32_DeviceChangeEvent")
        w = New ManagementEventWatcher(q)
        w.Start()
    End Sub
 
    Private Sub w_EventArrived(ByVal sender As Object, ByVal e As _
      System.Management.EventArrivedEventArgs) Handles w.EventArrived
        Dim dInfo As New DeviceEventInfo
        dInfo.fireTime = DateTime.Now
        For Each mp As Management.PropertyData In e.NewEvent.Properties
            If mp.Name = "DriveName" Then
                dInfo.driveName = mp.Value
                dInfo.deviceType = DeviceType.Parse(GetType(DeviceType), _
                  GetDriveType(mp.Value))
            ElseIf mp.Name = "EventType" Then
                dInfo.eventType = EventType.Parse(GetType(EventType), _
                  mp.Value.ToString)
            ElseIf mp.Name = "SECURITY_DESCRIPTOR" Then
                ' soll eigentlich in die dinfo 
                MsgBox(mp.Value.ToString) ' DAS GEHT NICHT
            ElseIf mp.Name = "TIME_CREATED" Then
                ' das ist die zeit zu der der event generiert wurde !
                Dim p As UInt64 = mp.Value
            Else
                MsgBox(mp.Name & " | " & mp.Value.ToString)
            End If
        Next
    End Sub
 
    Private Sub Form1_Closing(ByVal sender As Object, ByVal e As _
      System.ComponentModel.CancelEventArgs) Handles MyBase.Closing
        w.Stop()
    End Sub