What to do when you find an unfamiliar USB drive

The casing cannot establish trust

A familiar logo, a handwritten label or an ordinary-looking connector does not prove that a USB device is safe. USB Memory Direct’s awareness article discusses the risk of connecting unknown drives and recommends involving the appropriate support team. Its useful central point is that curiosity is not a sound security check.

Do not connect a found device to a personal or work computer just to discover its owner. The apparent contents are only part of the question; a device’s behaviour cannot be established from its appearance.

Use the right return route

If the drive is found at work, a school or an event venue, pass it to the responsible IT, security or lost-property team. Tell them where and when it was found. Let the organisation decide whether inspection is necessary and which controlled process is appropriate.

Do not assume that borrowing an old laptop or turning off a network connection makes an improvised inspection safe. The people responsible for the environment should make that decision with suitable equipment and procedures.

Apply the same discipline to received media

For business deliveries, keep an identifiable supplier and order record. Follow the receiving organisation’s removable-media policy before using a drive, even when the packaging looks professional. A security scan can be one part of an approved process, but it should not be described as a guarantee that all possible risks have been eliminated.

Make legitimate handovers recognisable

For your own USB distribution, use clear branding, a contents note and a known point of contact. Explain why the recipient is receiving the device and what it contains. These steps support a sensible verification process without asking people to ignore their organisation’s security rules in order to view promotional material.