8

As from the subject, I want to see what's inside. I am seriously interested in finding the owner if possible and returning them, but I am worried it could be an attempt at social engineering. I own a MacBook Pro Intel with OS X v10.6 (Snow Leopard). It is a very important install.

What would you do in my situation if you want to see the content without risks? Any proposal is welcome.

I decided not to plug them in, and I brought them to the hotel reception. They will forward it to the police.

25
  • Of course, you don't know for sure it's a drive to start with. Even if the casing tells you it's a drive, it could be just any kind of device. – Arjan Oct 31 '09 at 12:18
  • what's a drive? I always called them like this. – Stefano Borini Oct 31 '09 at 12:34
  • 1
    Now my only hope is that it goes back to his legitimate owner. I did my part – Stefano Borini Oct 31 '09 at 13:57
  • 1
    @Arjan: since Stefano didn't replied after your last comment, can we assume you were right about his job (that is, he is working at some nuclear power plant, or secret government agency, or for a company that has very powerful and evil competitors)? :D – dag729 Jun 9 '10 at 9:28
  • 2
    Please do not vandalize your posts. Once you've posted a question, you have licensed the content to the Super User community at large (under the CC-by-SA license). If you would like to disassociate this post from your account, see What is the proper route for a disassociation request? – CalvT May 8 '17 at 14:20
11

Why look at the content? I can understand that you are curious, but the content of those drives is none of your business. If you lost a drive, would you want others to look at the content?

Leave some notes in the area where you found them or bring them to the lost property office if you have one.

6
  • 4
    Here is Tokyo. I don't know how to write, I don't know where I was, I don't know how to put a post it note in the middle of the street. If I find a wallet, I would look for personal documents. Why shouldn't I do the same for a lost drive ? – Stefano Borini Oct 31 '09 at 10:12
  • 7
    And if I lost my drive, it would contain an encrypted image, with a clear text file containing my email address. – Stefano Borini Oct 31 '09 at 10:13
  • 2
    Further to this - in the rarest circumstance of the drives actually being of some importance (e.g. government / military), even attempting to access them could wind you up in a whole heap of trouble. – Ian Oct 31 '09 at 10:46
  • 2
    So chances are it's all Japanese after you plug it in... If you can't read that, and given iAn's comment, I guess dropping it off at some police station is all your Scout's Duty can do then? – Arjan Oct 31 '09 at 11:25
  • Because I speak no japanese and they 99.9% speak no english. I was hoping that the usb stick contains what I said it's on mine "if found please send mail to " and then an encrypted file, but maybe I'm a dreamer. – Stefano Borini Oct 31 '09 at 12:28
18

Disconnect from network. Boot from CD. Do not mount HDD.

Plug in USB drives, mount them and poke around.

3
  • that was my idea too, however... Linux for intel mac is a pain. If I boot OSX install cd, the HDD gets mounted in any case. – Stefano Borini Oct 31 '09 at 10:27
  • is it? I've often run ubuntu livecd countless times with no problems, no hdd mounted. osx install cd of course is another matter, plus it's definitely not linux. care to detail your problems? – ptor Oct 31 '09 at 14:14
  • kernel panics at boot. apic troubles. tried many solutions as proposed on the net, with no result. – Stefano Borini Nov 1 '09 at 12:24
4

It could be full of nanites that are going to crawl into your computer and turn it into the master computer for the super-secret Tristan da Cuhna nuclear program. :)

All kidding aside, with the possibility that it could have some form of malware, government secrets, terrorist documents, data used in identity theft, illegal pornography, or child pornography your best bet is to turn it over to law enforcement in whatever jurisdiction you found it in with as much information about where you found it as possible. Leave it to them to figure out what to do with the USB stick.

1

If booting to a LiveCD is not an easy option, do you have any virtualization software? You could create a virtual machine and connect the device to that isolated machine. I've done that in the past using VMWare Workstation. You could probably download an eval copy of VMWare Workstation, which allows sharing of USB devices.

I would be careful that you know the USB device is going to be connected to the VM and not the host. I've done this enough in the past that I was comfortable knowing that the device would be connected to the VM and not my host machine.

To be safer, make sure the VM OS does not have any sensitive information or connectivity to sensitive information (i.e. network connectivity or other sharing with the host).

Edit: I've actually done this too. Turns out the drive contained the person's entire work portfolio. I was able to track down her contact information from the content on the device. She was so relieved when I returned the device to her. It was a very attractive drive too. I asked her if she knew where I could get one, but she got it as a gift in Korea, so she didn't know where I could find one. It was very similar to the Pico USB flash on Thinkgeek, except that the pins weren't exposed.

1

Just open it! OS X doesn't have any form of AutoRun, and (unlike Firewire) USB does not allow Direct Memory Access attacks. So looking through the USB stick and not executing anything would be perfectly safe.

7
  • 1
    The op states USB drive, I suppose it could be some sort of starship engine, in which case plug it in faster :P – Phoshi Oct 31 '09 at 11:09
  • I've no idea, been a windows/linux guy all my life, but it sounds plausable to me. – Phoshi Oct 31 '09 at 11:10
  • Unless my Google-Fu is failing me, there's no USB DMA vulnerabilities on a Mac. So, cleaned up my comments a bit (and added a link to Firewire vulnerabilities as a reference). – Arjan Oct 31 '09 at 12:16
  • That's indeed my worry. That plugging specially crafted stuff could compromise my security. I know that mac is not windows, but you never know. – Stefano Borini Oct 31 '09 at 12:30
  • Aye. If it is a social engineering thing, the attacker would most likely aim the device at Windows machines, partially because there are more people using them, and partially because you're more likely to get somebody who would plug in a USB drive without thinking, triggering the trap. I think you'd be safe, but, of course, it never hurts to be careful with these things. – Phoshi Oct 31 '09 at 12:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.