Handle an unknown USB drive without plugging it in

Treat the hardware as untrusted

A USB device can do more than store files. Some devices present themselves as keyboards or other hardware, and a familiar enclosure does not establish what is inside. Antivirus is not a reason to plug an unknown device into a production computer simply to find its owner.

This guide is an operational handling routine. It does not teach malware analysis or require building a special testing station.

Route the item without using it

1. Leave the device disconnected. Note where and when it was found and any ordinary external label, without opening it or connecting it to a phone or computer.
2. Use the organisation's approved lost-property or IT contact. Describe the item and discovery location. Do not publish any potentially sensitive label or serial number unnecessarily.
3. Let the authorised owner decide how it should be assessed or returned. A person claiming it contains urgent work files should still follow the normal ownership process.
4. If the device belongs to an expected legitimate workflow, obtain a verified approved copy through the usual transfer route rather than making an exception for an unexplained found device.

If someone already connected it

Record the computer, time and observed behaviour. Include whether a prompt appeared, a file was opened or commands seemed to run automatically. Disconnect the device through the appropriate process and inform the responsible administrator. Avoid repeatedly connecting it to reproduce the event on more machines.

Preserve useful context

Keep the physical item handled according to the organisation's incident process if investigation is required. Do not erase or reformat it merely to make it safe for future use. That can destroy evidence without addressing every hardware risk.

Make the policy practical

Staff should know where to hand in a device and how to obtain legitimate files when removable media is not accepted. A rule that prevents necessary work without offering a transfer route encourages unsafe improvisation.

Review routine removable-media use

For approved devices, use the organisation's supported security and data-handling controls. Keep ownership clear and avoid sharing a single untracked drive among unrelated systems. The safest outcome for an unknown device is a verified handling decision, not a clean scan screenshot obtained by exposing a work computer first.