Could connecting removable media alter it?¶

Yes. Connecting removable media can alter both the media and the computer used to access it.

Avoid this assumption: Simply inserting a device is a passive act. Operating systems may write indexing data, thumbnail caches, system folders, access times, security metadata or file-system repair information.

Applications may automatically scan, synchronise, import, preview or open files.

The media may also execute software, present multiple device functions or trigger security controls.

Before connection, record the media’s condition, labels, serial number, capacity, switches, adapters and packaging.

Do not connect it to an ordinary device merely to identify the files.

If connection is required, use an approved specialist process that limits or documents changes.

Record the computer, interface, tool, operator, date, time and purpose.

Preserve any write-protection setting, but do not assume a physical switch or software setting guarantees no change.

If the media was already connected when found, record the host device, port, account, visible applications and any files or transfers shown.

Do not remove it automatically. Active writing, encryption, copying or database activity may be in progress.

If removal is necessary, record the reason, time and resulting system messages.

Do not treat later metadata as though it existed before investigator access.

Where comparison is possible, separate original records from those created by examination.

Record whether the operating system proposes repair, formatting or encryption action, and do not approve any prompt without specialist direction.

Operational takeaway¶

Assume connecting removable media may create or change records on both systems, and preserve the original state before any controlled, documented access.