When should removable media be handled only by a specialist?¶

Removable media should be handled only by a specialist when ordinary movement, connection or removal could damage evidence, trigger malware or alter a live system.

Avoid this assumption: Every USB device, memory card or external drive can be safely bagged and examined later. Some items are encrypted, damaged, actively connected, unusually configured or essential to a live service.

Seek specialist support where the media is already connected to a powered-on device and data transfer, encryption, backup or database activity may be in progress.

Escalate where the media appears physically damaged, wet, modified, tampered with or fitted with unfamiliar switches, keypads or multiple connectors.

Specialist handling is also appropriate where malware, booby-trapped hardware, cryptocurrency access, hardware authentication or proprietary systems are suspected.

Do not remove drives from RAID, NAS, server or industrial systems without understanding the wider configuration.

Where the media is part of a business-critical or public-safety system, consider service continuity before seizure or disconnection.

Record the item, its location, power state, connections, host device, visible activity, labels and surrounding equipment.

Preserve the scene and prevent unnecessary access while support is obtained.

If immediate action is required to prevent harm, use the least destructive effective measure and document why waiting was not possible.

Do not improvise passwords, PINs, repair tools, malware scans or file-system checks.

Record who provided specialist advice, when and what action followed.

Operational takeaway¶

Use specialist handling where removable media is live, encrypted, damaged, malicious, proprietary or operationally critical, and preserve its full context while assistance is obtained.