Malware Protection

The USB Drive You Found or Were Given — What to Do Before Plugging It In

A USB stick found in a parking lot, received at a conference, or mailed to you is a classic malware delivery vector. Here's what the risks are and how to safely examine one.

By AdsBlocks Team·October 23, 2026

The USB Drive You Found or Were Given — What to Do Before Plugging It In

The USB Drop Attack — It Actually Works

Security researchers have tested this scenario repeatedly: dropping USB drives in parking lots and public spaces to see how many people plug them in.

In a widely cited 2016 experiment at the University of Illinois, researchers dropped 297 USB drives around campus. Approximately 48% were plugged in and files were opened. A 2022 follow-up showed similar results despite years of security awareness training in the intervening period.

The curiosity factor is powerful. When someone finds a labeled USB drive — "Salary Information Q4," "Private Photos," "Confidential" — the temptation to look is extremely strong.

Types of Malicious USB Devices

Not all dangerous USB devices look like ordinary flash drives. The threat landscape includes:

Malware-loaded drives: Contain files that exploit autorun features or trick users into opening malicious documents. The most basic category.

Rubber Ducky / HID attack devices: Look like a USB drive but enumerate as a keyboard. When plugged in, they automatically type commands at machine speed — faster than any human. They can install malware, create backdoors, or exfiltrate data in seconds.

USBKill: A capacitor-based device that stores power and then discharges it into the USB port, destroying the host machine. These are used for data destruction.

Firmware-modifying devices (BadUSB): Modify the controller firmware of legitimate USB devices to perform malicious actions even after a "clean" flash drive has been reformatted.

What a "Received" USB Drive Could Be

Beyond drives found in public, be aware of:

Conference swag — malicious actors have distributed infected drives at security conferences as a stunt or genuine attack

Mailed drives — targeted attacks against organizations have used USB drives mailed to employees with convincing cover stories

Client or partner deliverables — supply chain attacks sometimes involve infected media passed between organizations

Your own old drives — drives you stopped using may contain older unscanned files from a time when your security practices were less rigorous

How to Safely Examine an Unknown USB Drive

Option 1: Don't. If you have no legitimate reason to examine the drive, dispose of it. This is always the safest option.

Option 2: Use an isolated machine. A cheap laptop running a fresh OS with no network connection limits the blast radius. If you're technically capable, a live boot of a Linux distribution (Tails, Ubuntu Live) that doesn't write to the hard drive is a reasonable environment.

Option 3: Use USB scanning software before opening anything. Mount the drive and scan with an up-to-date antivirus before opening any files. This catches known malware but not zero-day exploits or HID attacks.

What never works: Plugging the drive into your regular computer "just to see" while expecting your antivirus to catch everything in time.

Bottom Line

Found USB drives should be treated as hostile until proven otherwise. Received drives from unknown sources should be treated with the same skepticism. If you need to examine one, use an isolated machine without network access.

Protect Yourself Today

The #1-rated antivirus covers all the threats mentioned in this article.

Get TotalAV — $1.99/month →