up vote 9 down vote favorite
3
share [g+] share [fb]

If you have a USB Drive that may or may not be contaminated, what is the best way to retrieve data from it without reinfecting yourself?

link|improve this question
feedback

6 Answers

up vote 20 down vote accepted

If you want to be completely sure, mount it on a Mac or Linux box. Seriously.

For an example, see the new shortcut icon exploit, which ALL Windows machines since NT have been vulnerable to. This exploit allows arbitrary code to be executed simply when the folder is opened. No Autorun required. No manual execution required. It infects the system as soon as the folder is opened.

http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Exploit%3AWin32%2FCplLnk.A

If you don't have a real *nix (includes Mac) box, just boot from a LiveCD. You may want to scan with Clam AntiVirus while you're at it too.

link|improve this answer
2  
+1 - If it's a Windows machine, load it on OSX or Linux, or a Windows box you don't care about. – JNK Jul 26 '10 at 16:33
2  
Absolutely! May want to edit this post to include running from a LiveCD in case there isn't a Linux box handy. Then scan with Clam – Dennis Jul 26 '10 at 17:58
feedback
up vote 7 down vote

The first thing you absolutely need to do is disable autorun. There is a good tutorial here.

If it were me though, I'd boot to a non-writable OS (e.g. Knoppix) and copy the data off that way. Knoppix is outstanding for this sort of recovery.

link|improve this answer
feedback
up vote 6 down vote

Mount it on a computer booted off of a Linux live boot CD and the hard drives (and any other USB drives too) disconnected.

link|improve this answer
feedback
up vote 1 down vote

If you are using windows then disable auto-run.

How to disable autorun: http://support.microsoft.com/kb/967715

link|improve this answer
feedback
up vote 0 down vote

Disable auto-run as mentioned by Daisetsu and use the Command Prompt which won't be exploited.

link|improve this answer
feedback
up vote 0 down vote

Holding the left shift while inserting the drive will temporarily disable autorun

link|improve this answer
1  
It is however not the most reliable method I have seen. – Gnoupi Aug 22 '10 at 6:43
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.