---
{
  "title": "Data from Removable Media",
  "summary": "Collection from removable media targets information available on attached storage.",
  "topic": "soc",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    6
  ],
  "aliases": [
    "T1025"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1025: Data from Removable Media",
      "url": "https://attack.mitre.org/techniques/T1025"
    }
  ],
  "editorialVersion": 2
}
---

## Attached storage can expose another dataset

Collection from removable media reads information on storage attached to an accessed system. USB drives, external disks, and other removable resources may contain data not normally stored on the host. The collection opportunity depends on the media being available, its protection, and the permissions of the accessing process.

This differs from using removable media to carry malicious software between systems. [[replication-through-removable-media]] addresses that movement path. Here the focus is information being gathered from the attached storage.

## A connected drive becomes part of the case

In a fictional office, a staff member connects an external drive containing project documents. Endpoint telemetry later shows an unexplained process accessing the mounted volume and creating local files. The analyst checks device connection records, volume identifiers, process activity, relevant file events, and timing.

A legitimate backup or synchronization application could produce similar behavior. Compare the process with the user's intended task, installed software, and expected output. A connection event establishes that media was attached under the source's semantics; it does not by itself establish that its contents were read.

Drive letters or mount paths can be reused, so preserve stronger identifiers where available. The same visible path at two different times may refer to different media. Time and device context are essential when correlating access.

## Protect the evidence and the owner's information

The media may contain sensitive personal or business information outside the immediate incident scope. Handle it through an authorized process, document custody where appropriate, and avoid unnecessary browsing. If acquisition is required, use suitable forensic methods rather than casually modifying the original.

Encryption affects access, but its meaning depends on whether the volume was unlocked during the relevant period. An encrypted drive available to the user's session may expose readable content to processes with sufficient access in that session.

[[digital-forensics]] supports preservation discipline, while [[data-from-local-system]] helps distinguish source data from local copies created afterward.

## Limit ongoing collection

Restrict the suspicious process or host as justified and review whether local copies, archives, or transfers followed. Removing the drive may stop further reads from it, but it does not remove information already copied elsewhere.

For practice, construct a timeline containing a drive connection, a document read, a local archive, and an external upload. Identify which evidence connects each stage and which relationships remain hypothetical. Explain how the conclusion changes if only the connection record survives. [[exfiltration]] and [[incident-reporting]] help avoid describing a connected device as proof of data theft.

## Related concepts

- [[mitre-attack]]
- [[logs-and-telemetry]]
- [[incident-response]]
- [[automated-collection]]