If you have a USB Drive that may or may not be contaminated, what is the best way to retrieve data from it without reinfecting yourself?
-
Related: How can I browse an untrusted USB flash drive safely?, Is there any way to safely examine the contents of a USB memory stick?, What is the danger of inserting and browsing an untrusted USB drive?, How can a flash drive spread a virus?, and How can USB sticks be dangerous?, and probably more.– Scott - Слава УкраїніMay 6, 2017 at 21:53
6 Answers
If you want to be completely sure, mount it on a Mac or Linux box. Seriously.
For an example, see the new shortcut icon exploit, which ALL Windows machines since NT have been vulnerable to. This exploit allows arbitrary code to be executed simply when the folder is opened. No Autorun required. No manual execution required. It infects the system as soon as the folder is opened.
If you don't have a real *nix (includes Mac) box, just boot from a LiveCD. You may want to scan with Clam AntiVirus while you're at it too.
-
3+1 - If it's a Windows machine, load it on OSX or Linux, or a Windows box you don't care about.– JNKJul 26, 2010 at 16:33
-
2Absolutely! May want to edit this post to include running from a LiveCD in case there isn't a Linux box handy. Then scan with Clam– DennisJul 26, 2010 at 17:58
-
Completely safe, because macOS and Linux are invulnerable to malware? No. Seriously. They are less vulnerable, maybe, but Linux is not immune to viruses. If you disconnect all your storage devices (HDDs, SSDs, etc.) and your network connection, and boot from a LiveCD, then maybe you are relatively safe from malware. May 6, 2017 at 20:30
Mount it on a computer booted off of a Linux live boot CD and the hard drives (and any other USB drives too) disconnected.
If you are using windows then disable auto-run.
How to disable autorun: http://support.microsoft.com/kb/967715
Holding the left shift while inserting the drive will temporarily disable autorun
-
1
Disable auto-run as mentioned by Daisetsu and use the Command Prompt which won't be exploited.