Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As from subject. I want to see what's inside. I am seriously interested in finding the owner if possible and returning them, but I am worried it could be an attempt at social engineering. I own a macbook intel with OSX 10.6. It is a very important install.

What would you do in my situation if you want to see the content without risks ? Any proposal welcome.

Edit: I decided not to plug them in, and I brought them to the hotel reception. They will forward it to the police.

share|improve this question
Of course, you don't know for sure it's a drive to start with. Even if the casing tells you it's a drive, it could be just any kind of device. – Arjan Oct 31 '09 at 12:18
what's a drive? I always called them like this. – Stefano Borini Oct 31 '09 at 12:34
He means that while it looks like a USB stick (or usb drive, usb key, usb dongle, memory stick, memory key, file tube (no, really), or one of any other hundreds of possible names because it wasn't standardized), it could actually be something else entirely, designed to LOOK like a USB stick - however I don't think it could do any damage by itself. – Phoshi Oct 31 '09 at 12:42
Now my only hope is that it goes back to his legitimate owner. I did my part – Stefano Borini Oct 31 '09 at 13:57
@Arjan: since Stefano didn't replied after your last comment, can we assume you were right about his job (that is, he is working at some nuclear power plant, or secret government agency, or for a company that has very powerful and evil competitors)? :D – dag729 Jun 9 '10 at 9:28
up vote 9 down vote accepted

Why look at the content? I can understand that you are curious, but the content of those drives is non of your business. If you lost a drive, would you want others to look at the content?

Leave some notes in the area where you found them or bring them to the lost property office if you have one.

share|improve this answer
Here is Tokyo. I don't know how to write, I don't know where I was, I don't know how to put a post it note in the middle of the street. If I find a wallet, I would look for personal documents. Why shouldn't I do the same for a lost drive ? – Stefano Borini Oct 31 '09 at 10:12
And if I lost my drive, it would contain an encrypted image, with a clear text file containing my email address. – Stefano Borini Oct 31 '09 at 10:13
Further to this - in the rarest circumstance of the drives actually being of some importance (e.g. government / military), even attempting to access them could wind you up in a whole heap of trouble. – iAn Oct 31 '09 at 10:46
So chances are it's all Japanese after you plug it in... If you can't read that, and given iAn's comment, I guess dropping it off at some police station is all your Scout's Duty can do then? – Arjan Oct 31 '09 at 11:25
Because I speak no japanese and they 99.9% speak no english. I was hoping that the usb stick contains what I said it's on mine "if found please send mail to " and then an encrypted file, but maybe I'm a dreamer. – Stefano Borini Oct 31 '09 at 12:28

Disconnect from network. Boot from CD. Do not mount HDD.

Plug in USB drives, mount them and poke around.

share|improve this answer
that was my idea too, however... Linux for intel mac is a pain. If I boot OSX install cd, the HDD gets mounted in any case. – Stefano Borini Oct 31 '09 at 10:27
is it? I've often run ubuntu livecd countless times with no problems, no hdd mounted. osx install cd of course is another matter, plus it's definitely not linux. care to detail your problems? – ptor Oct 31 '09 at 14:14
kernel panics at boot. apic troubles. tried many solutions as proposed on the net, with no result. – Stefano Borini Nov 1 '09 at 12:24

It could be full of nanites that are going to crawl into your computer and turn it into the master computer for the super-secret Tristan da Cuhna nuclear program. :)

All kidding aside, with the possibility that it could have some form of malware, government secrets, terrorist documents, data used in identity theft, illegal pornography, or child pornography your best bet is to turn it over to law enforcement in whatever jurisdiction you found it in with as much information about where you found it as possible. Leave it to them to figure out what to do with the USB stick.

share|improve this answer

Just open it! OS X doesn't have any form of AutoRun, and (unlike Firewire) USB does not allow Direct Memory Access attacks. So looking through the USB stick and not executing anything would be perfectly safe.

share|improve this answer
The op states USB drive, I suppose it could be some sort of starship engine, in which case plug it in faster :P – Phoshi Oct 31 '09 at 11:09
I've no idea, been a windows/linux guy all my life, but it sounds plausable to me. – Phoshi Oct 31 '09 at 11:10
Unless my Google-Fu is failing me, there's no USB DMA vulnerabilities on a Mac. So, cleaned up my comments a bit (and added a link to Firewire vulnerabilities as a reference). – Arjan Oct 31 '09 at 12:16
Ah, thank you :) – Phoshi Oct 31 '09 at 12:18
That's indeed my worry. That plugging specially crafted stuff could compromise my security. I know that mac is not windows, but you never know. – Stefano Borini Oct 31 '09 at 12:30

Try to run a virtual machine and connect the usb under it ;) if there is a virus inside, they'll affect only the virtual machine. Or try with a linux live cd.

share|improve this answer

Is there no way to disable autorun? There might be a virus/trojan in the usb drive, but if it's not ran there is no problem :)

share|improve this answer
Trust me, there can still be problems. A 12 year old in my class managed to bypass autorun the other day. – The Green Frog Nov 3 '09 at 17:34
How? Was this in windows? I would really like to know how he managed to run something without the autorun. – AntonioCS Nov 4 '09 at 0:18
This is really a comment, not an answer to the question. Please use "add comment" to leave feedback for the author. – Diogo Aug 9 '12 at 20:11

If booting to a LiveCD is not an easy option, do you have any virtualization software? You could create a virtual machine and connect the device to that isolated machine. I've done that in the past using VMWare Workstation. You could probably download an eval copy of VMWare Workstation, which allows sharing of USB devices.

I would be careful that you know the USB device is going to be connected to the VM and not the host. I've done this enough in the past that I was comfortable knowing that the device would be connected to the VM and not my host machine.

To be safer, make sure the VM OS does not have any sensitive information or connectivity to sensitive information (i.e. network connectivity or other sharing with the host).

Edit: I've actually done this too. Turns out the drive contained the person's entire work portfolio. I was able to track down her contact information from the content on the device. She was so relieved when I returned the device to her. It was a very attractive drive too. I asked her if she knew where I could get one, but she got it as a gift in Korea, so she didn't know where I could find one. It was very similar to the Pico USB flash on Thinkgeek, except that the pins weren't exposed.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .