---
{
  "title": "Peripheral Device Discovery",
  "summary": "Peripheral discovery identifies attached devices that can reveal a host's role or collection opportunities.",
  "topic": "forensics",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    2
  ],
  "aliases": [
    "T1120"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1120: Peripheral Device Discovery",
      "url": "https://attack.mitre.org/techniques/T1120"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Peripheral discovery identifies attached devices that can reveal a host's role or collection opportunities. Devices include storage, cameras, microphones, and other components.


## An investigation example

An unfamiliar process inventories connected cameras and removable storage before further collection activity.

## Evidence to examine

Review device queries, process ancestry, attached-device history, and subsequent access to identified peripherals.

## A common analytical pitfall

Device enumeration is not equivalent to activating a camera or copying removable storage.

## Response considerations

Preserve the discovery sequence and verify whether any identified devices were actually used for unauthorized operations.


## Attached devices can describe a host's role

Information about connected storage, cameras, printers, and other peripherals can reveal how a computer is used and what collection opportunities exist. The meaning depends on the device and workflow. Discovering a camera does not prove that it was activated, and finding removable storage does not prove files were copied to it.

Inventory tools and operating-system services legitimately enumerate devices. Investigators should connect the query to its requesting process, account, and subsequent behavior. Device identifiers can be useful, but naming and reassignment may complicate interpretation. Preserve the source and observation time rather than assume the same peripheral remained attached throughout the incident.

## A fictional removable-storage lead

An academy's endpoint records show an unfamiliar process checking attached devices shortly before file activity involving removable storage. Analysts compare device events, file operations, process ancestry, and approved support work. They distinguish the existence of a storage device from evidence of specific content being written to it.

Collection and reporting should remain proportionate. Peripheral information can reveal user context or sensitive operational arrangements. If the relevant logs are incomplete, state the gap instead of using the device's presence to fill in a desired narrative. A later physical inspection may show current attachment but not establish the earlier state.

## Compare three claims

Create fictional events for device enumeration, device attachment, and a file write. Write the narrow claim supported by each. Then identify the evidence needed to connect the file write to a particular removable device. The exercise develops a clear progression from discovery to use without requiring unauthorized monitoring or copying information from real external drives.

Device enumeration may return logical or previously known devices as well as currently usable hardware, depending on the source. Check the API or artifact semantics before calling every listed peripheral physically present. That distinction is especially important when interpreting removable storage or virtual devices in a reconstructed host timeline.

## Related concepts

- [[digital-forensics]]
- [[incident-timeline]]
- [[logs-and-telemetry]]