I accidentally gave my USB to my friend and then I realized it had some important files of mine. Is there any way I can know if he got something from the USB?
No logs are recorded on the USB itself around file accesses. At best, you might know if the files were changed by looking at the file timestamps, which can sometimes happen just by opening them, depending on the program opening them.
But there will be no way to determine, by looking at the USB, if the files were copied.
There is no way to be sure by strictly technical means.
On the one hand, if your friend has antivirus software installed, it would probably scan your USB stick as soon as it was plugged in their machine; and this would be completely indistinguishable from data being read as a part of copy operation.
On another hand, if they would like to cover their tracks, there are many ways to reset the timestamps, and to prevent their change in the first place.
So... ask them? Get access to their machine and check for the copies your files (if they agree)? Tell them that your data was sensitive and kindly ask to delete it if they accidentally copied it? These might be the questions for Interpersonal and Law SE's; security-wise, your data are already compromised.
It depends on what kind of filesystem is on the disk. Most filesystems retain an access time that can be viewed with
ls -lu, provided the "friend" mounted the filesystem read/write. (Note: apparently Windows OSes have no equivalent to
ls -lu, so this won't be useful if that's what you have).
If the "friend" mounted the filesystem read-only (or with
noatime or similar options), or the disk has a filesystem that doesn't store access times (notably FAT and derivatives), or he covered his tracks by using
utime() after reading, then you won't see this evidence.
Alternatively, you might get a "false positive" if something on his system read the file autonomously (e.g. for generating summaries, or looking for malware), but he didn't see the contents or copy the files.
In the end, what little information that is recorded on the media tells you very little about whether the information was accessed, and if so, how it was accessed.
You could try
dir /T:A and compare with
/T TimeField Specify the time field displayed
and used for sorting. TimeField may be any of the
C : Creation time.
A : Last access time.
W : Last write time.
For instance, when you use the option "/T:C," the
time listed is when the file was created.
By default, there will be no record of such activity.
When a file is accessed or changed, either the OS or the application can update its "last write" or "last access" property.
Per Microsoft's documentation:
NTFS also permits last access time updates to be disabled. Last access time is not updated on NTFS volumes by default.
Your friend could copy any file(s), and I would not expect the "last access" date to change.
In addition, any auditing for failed/successful attempts to access files would be recorded in the Security log on his computer.
An Inconclusive Method
The only other method is checking for foreign SIDs on file/folder ACLs. If you look at the permissions on a file (on the Security tab), unresolved SIDs may appear.
Unresolved SIDs appear as long strings, such as S-1-5-21-3624371015-3360199248-30038020-3220, rather than human-readable names like SYSTEM, Network Service, or JohnSmith.
Note that foreign SIDs will only be added if he took ownership of files or modified permissions, so the absence of such SIDs does not indicate a lack of access.