Published August 31, 2026
Why I Became More Careful With USB Drives
I found a USB drive sitting on a table in a shared space, unlabeled, no obvious owner nearby to ask. Curious more than cautious, I plugged it into my laptop when I got home, mostly to see if there was any way to identify whose it was so I could return it.
The Problem
Nothing happened immediately — no obvious error, no dramatic warning. A folder opened showing a handful of generic-looking files, nothing that told me anything about an owner. I closed it, ejected the drive, and didn't think much more about it that evening. It was only afterward, reading something unrelated, that I actually stopped to think about what I'd just done.
What I Initially Thought
In the moment, I genuinely hadn't thought of it as risky at all — it was just a USB drive, the same category of object I'd plugged in countless times without a second thought. It didn't register as a decision with any real weight until well after I'd already made it.
What I Tried
Once I actually paused to think it through, I ran a full scan with Windows Security, specifically checking whether anything had been able to run automatically the moment the drive connected. It came back clean, which was reassuring, though I also went and looked into why a found, unfamiliar USB drive is specifically treated as a risk in security guidance I'd skimmed before but never really internalized.
What I Discovered
An unfamiliar USB drive can be used to deliver malicious software automatically, sometimes without requiring you to open any specific file at all, depending on how it's set up and what autorun behavior your system allows. This is a well-documented tactic, deliberately relying on curiosity — leaving a drive somewhere it's likely to be found and plugged in out of simple curiosity, exactly the situation I'd walked into without thinking twice.
I got lucky, as far as I could tell — the scan found nothing, and nothing unusual happened to my system afterward. But the fact that I'd gotten lucky rather than having actually made a careful, informed decision stuck with me more than the immediate scare of the moment.
What I Changed
I don't plug in USB drives I don't know the origin of anymore, full stop, regardless of how harmless the situation seems. If I genuinely need to check an unfamiliar drive for some legitimate reason, I know now that a dedicated, isolated environment — not my everyday laptop — is the appropriate way to do that safely, rather than treating my main computer as disposable enough to risk.
The Lesson
The risk wasn't dramatic or obvious in the moment, which is precisely why it was easy to walk right past it. I think that's true of a lot of these small security decisions — they rarely announce themselves as decisions at all, and by the time you realize you made one, it's usually already been made.
Practical Takeaway
- Don't plug an unfamiliar USB drive of unknown origin into your everyday computer, even out of simple curiosity.
- If you must check an unfamiliar drive, use a dedicated, isolated system for it rather than your main computer.
- Run a full antivirus scan immediately if you've already connected an unfamiliar drive, even if nothing seems obviously wrong.
- Recognize that a found drive left somewhere it's likely to be picked up is a known tactic, not just an innocent lost-and-found situation.
- Treat "it seemed harmless in the moment" as exactly the reason these situations work, rather than a reason to relax about them.
A Personal Ending
I think about how little thought I gave to plugging that drive in, and how much more thought I've given it since, entirely after the fact. Since then, an unfamiliar drive gets left alone rather than plugged in out of curiosity, regardless of how low-stakes the moment feels.
Had a small, unremarkable decision turn out to carry more risk than you realized at the time? I'd like to hear about it.