Found an unknown USB drive? Do not test it on your everyday PC

A USB drive found in a public place or delivered unexpectedly could contain malicious files or altered hardware. Even if it looks like a gift or carries a company logo, you do not know how it was prepared. Antivirus scanning is useful after exposure but does not make unknown hardware risk-free.

Choose the right branch​

1. Not inserted yet? Do not plug it into your computer, phone or charger. At work, give it to IT or follow your organization's lost-media process. At home, avoid trying to identify the owner by opening its files.
2. Inserted but nothing opened? Do not browse or execute files. Safely eject it if possible, then check Windows Security and scan the computer. Record when it was inserted and whether any prompts appeared.
3. Opened a file or approved a prompt? Stop using that PC for sensitive accounts, run an up-to-date scan and seek help if behavior changes. Review account activity from a separate trusted device if you entered passwords after the exposure.

Interpret a clean scan carefully​

A scan can inspect files it can access; it cannot certify every possible device behavior or prove no credential was exposed. Do not move the drive to several computers to get a second opinion. The UK NCSC explains that a USB device may even act like another kind of peripheral. Microsoft's file-scan instructions cover the scan step after insertion. For a file you intentionally downloaded, use our separate download checklist.

If you must return it​

Hand the drive to a known staff member or official lost-property channel without exploring its contents. Label where and when it was found so a trained team can handle it. Do not post a photo that reveals potential owner information, and do not connect it to a public kiosk just to see what is on it.