What should I do when I find a USB storage device?¶

Treat the USB device as a separate evidential item and preserve its location, condition and relationship to nearby people and equipment. Do not connect it to a computer to identify its contents.

Preserve the item and its context¶

Photograph it as found where practicable. Record its position, who possessed or controlled it and any associated computer, bag, adapter or paperwork. Capture the make, model, colour, capacity marking, serial number, labels, damage, switches and unusual attachments. These details help distinguish visually similar devices and may connect the item to other evidence.

Package it to prevent loss, physical damage and accidental connection, and record every handler and transfer. The label or circumstances may suggest ownership or purpose, but neither establishes who created or controlled the stored data.

A connected device presents a different problem¶

If it is already attached to a powered system, record the host, port, open applications, visible files, activity lights and any transfer or security alert before deciding what to do. Removal can interrupt a write, corrupt data, terminate a process or change the host's records.

Where active transfer, encryption, malware or unusual hardware behaviour is suspected, seek specialist advice. Examination should use a controlled process designed to protect both the original media and the system used to inspect it.