What should be recorded about removable storage?¶

Record removable media exactly where and how it was found, then preserve it without browsing, connecting or automatically removing it from a live system.

The physical and logical context both matter¶

Photograph the item, port and host together. Capture visible type, capacity, make, model, serial number, label and physical condition. If attached, preserve any visible volume name, file path, encryption prompt, warning or application using it.

USB devices are not necessarily storage: they may be authentication keys, wireless adapters or devices that emulate input. Do not infer function from appearance alone.

Media already mounted on a live system may support open files, encrypted containers, virtual machines or running applications. Automatic removal can terminate access or corrupt data. Loose media should be handled and packaged according to local evidence procedures with its finder and location recorded.

Improvised inspection creates new risk¶

Connecting unknown media to a general-purpose computer can alter timestamps, create system files, run automatic content or expose the examining device to malware. The first-response objective is preservation and identification, not content examination.

If urgent protection requires removal or isolation, document the reason, exact time, method and visible effect on the host. A controlled specialist process can later determine content and device function while preserving the source and explaining any changes.