A mobile phone is the most likely device that is causing this message, because it can be plugged into a USB port for charging or data transfer, and then unplugged when the user leaves the workstation. A mobile phone may also not be detected by the file audits, as it may not have any files stored on the workstation or may use encryption or password protection. A mouse, a scanner, and an external hard drive are less likely to be plugged and unplugged frequently, and they would also leave traces of their presence in the file audits or device manager. References: CompTIA IT Fundamentals+ FC0-U61 Cert Guide, Chapter 3: Device Ports and Peripherals, page 77; CompTIA IT Fundamentals+ (Exam FC0-U61) Module 4 / Unit 2 / Connecting to a Network, page 6; How to identify USB Ports in Device Manager?