This paper proposes a method for detecting remaining files copied from removable storage medium. The proposed method logs events that the database of a file system, “Folder”, is changed. The remaining file can be detected by tracing the sequence of logs using path/file-name matching. Our experimental result suggests that the proposed method can accurately detect remaining files left on the computer.