USB FLASH DRIVES
Small USB flash drives (aka pen drives, aka USB sticks) can be surprisingly dangerous, both their software and their hardware.
If you need to read files on a USB flash drive, the safest way is with a Chromebook in Guest Mode. If you need to save a file on a flash drive, the safest place is a Chromebook. Another safe environment is the Windows Sandbox in Windows 10 Professional and Windows 11 Professional (Enterprise version too).
DO A FRESH INITIALIZE
Any flash drive where you do not need to read the files (if any) that it contains should be re-initialized from a safe environment. This includes newly purchased flash drives.
As above, two safe environments are a Chromebook in Guest Mode and the Windows Sandbox in Windows 10/11 Professional. In each case, if there is malware on the flash drive, any changes the malware has made should be thrown away when the safe environment is shut down.
VALIDRIVE
For Windows users, Steve Gibson offers his free ValiDrive program. I highly recommend it. The program does three things
- It verifies that the flash drive is actually the size it says it is. There are many flash drives on the market (certainly sold at Amazon) that do not have the storage capacity they claim to have. This is a big scandal because these scam devices not only lie about their capacity, they also lie to the operating system about actually having written data.
- It runs speed tests for both reading and writing
- It verifies that 576 sections of the flash drive are perfectly functional for both reading and writing.
ValiDrive is a single EXE file, thus there is nothing to install and the program is portable.
DATA ROT
If left unused for long enough, an SSD (or a USB flash drive) can lose data. The experiment described below showed a non trivial amount of data rot after 2 years of neglect.
April 16, 2025: Unpowered SSD endurance investigation finds severe data loss and performance issues by Mark Tyson of Toms Hardware. Quoting: "You may not know it, but SSDs will lose data after a period of time if they are simply left unplugged, which can be a serious threat to your data ... A year-two update on the how long can SSDs store data unpowered video series is another reminder about the importance of regularly refreshing your backups with a bit of juice ... I have also experienced SSD data loss after leaving a Mini PC unpowered for just six months or so ... On return, Windows refused to boot or be repaired, but a reformat and reinstall seemed to return everything to normal." The article is about SSDs, but it is safe to assume it also applies to USB Flash Drives.
April 29, 2025: On Episode 1023 of his Security Now! podcast, Steve Gibson discussed the above experiment, explained the low level physics behind the data rot and added: "... temperature is crucially important. Several years ago we covered a piece of news that noted that offline SSDs stored in hot data centers tended to lose their data more quickly than the same SSDs stored in a cool environment. Heat inherently agitates electrons and increases the probability that one will make it across the cell’s insulating barrier. So if you do have any offline SSDs or thumb drives where you have important data stored, I’d give them a full data rewrite pass with SpinRite at Level 3, then put them in a zip-lock bag in a refrigerator, or at least store them somewhere cool."
HARDWARE
On the hardware side, the articles below show that a USB flash drive can both explode (when a person is the target of bad guys) or destroy the computer it connects with.
The first I had heard about exploding USB flash drives was in March 2023 as detailed in the articles below. As soon as the flash drive got power from the USB port in a computer, it exploded.
- Journalist hurt by exploding USB bomb drive by Thomas Claburn for The Register. March 22, 2023
- Journalist plugs in unknown USB drive mailed to him - it exploded in his face by Scharon Harding for Ars Technica. March 22, 2023
The defense here is a USB extension cord, preferably 6 feet or longer. Plug the cord into the flash drive and then stand far away from the flash drive when you plug the other end of the extension cord into a computer. Maybe even have a barrier between the flash drive and yourself. This is yet another reason to use a Chromebook for USB flash drives as they are, generally, cheaper than other computers. Then too, the below.
- 'USB Killer' flash drive can fry your computer's innards in seconds by Dan Goodin for Ars Technica. October 14, 2015. Booby-trapped USB stick delivers 220-volt charge to attached computer.
Other than avoiding anything but a brand new flash drive, the defense here, yet again, is a Chromebook. This time a very cheap one to serve as the sacrificial lamb, so to speak.
I first heard of the Malicious Cable Detector by O.MG in August 2023. It claims to detect all types of malicious USB cables. At the time, it sold for $40.