Could connecting removable media alter it?¶

Yes. Inserting removable media can cause changes on both the media and the host computer, even if the investigator only intends to look at a directory listing.

Changes can occur automatically¶

Operating systems may write indexing records, thumbnail caches, system folders, access times or file-system repair data. Applications may scan, import, preview, synchronise or open content without an explicit request. The host can also record the device identifier, connection time, user account and files accessed.

Some media exposes more than storage or triggers software and security controls. A write-protection switch can be relevant, but its presence does not prove that every interface, adapter or examination method prevented writes.

Distinguish original records from examination effects¶

Before any access, document the media's identifiers, condition, switches, adapters and packaging. A justified examination should use an approved method and record the host, interface, tool, operator, time, purpose and protective controls. Prompts to repair, format or encrypt the device should not be accepted casually.

If the media is already connected, preserve the visible host state and any active transfer before removal. Later metadata must be interpreted against the connection and examination log so that investigator-generated changes are not presented as earlier user activity.