The problem
A USB stick from a stranger, a conference, a car park or a 'customer' is a classic way in. It can carry infected documents and disguised programs, it can be a BadUSB that pretends to be a keyboard and types commands in two seconds, it can present itself as a network card and hijack the PC's traffic, or it can be a USB Killer that destroys the port. Windows mounts any storage device the moment it is plugged in, trusts any keyboard, and Windows Sandbox cannot see USB devices at all. Enterprise device-control products block ports for whole companies; nothing on a home or small-business PC lets one person open an unknown stick safely and see what it was trying to do.
Features
- Armed means held: with Quarantine on, every newly plugged USB device is stopped at the driver (a device-class filter) before any Windows driver, file system or keyboard input attaches, and its descriptors are read first: vendor, product, serial, interface classes, power draw
- Identity check before anything else: a device sold as storage that also presents a keyboard (HID), a network adapter (RNDIS or CDC) or a serial port is a BadUSB or PoisonTap-style attack and is refused outright, with the hidden interfaces named; a genuine keyboard or adapter you expect is allowed by its serial for next time
- Keystroke-injection guard even when not armed: a new keyboard that starts typing within seconds of plugging in, or faster than a person can, is cut off at once and its keystrokes are captured and shown as the attack script it tried to run
- The host never opens the file system: the stick is imaged sector by sector through the raw device handle (the same path USB Lab uses), the image is hashed, and only the image is attached, as a read-only virtual disk, to a disposable Hyper-V VM with no network and a clean snapshot, or to Windows Sandbox for a quick look
- Analysis inside the VM: every file's true type from its bytes against its extension, double extensions, hidden and system files, autorun.inf, shortcut (.lnk) targets, Office macros and OLE objects, scripts and installers, archives opened to depth, known-bad hashes from a local signature list, and an optional hash-only lookup against VirusTotal with nothing uploaded; documents and installers are then opened in the VM and their processes, file writes, registry changes and attempted network connections recorded
- Clean extraction: the files you actually wanted come out through content disarm and reconstruction (documents rebuilt without macros, scripts or embedded objects, images re-encoded, PDFs flattened) into a quarantine folder on the host, with the report alongside; the original image is kept for evidence or wiped with a verified erase
- Verdict and report: Attack device, Malicious files, Suspicious, or No bad behaviour observed, with the evidence for each, a timeline of what the stick tried to do, and a one-page summary you can send to whoever gave you the stick; IT can run a dedicated test-station PC in always-armed mode with an allow-list of company devices
How it works
Hold and identify
- Upper-filter driver on the USB hub class that holds new devices in a quarantined state until the identity check passes (allow-listed serials pass straight through)
- Descriptor analysis: interface classes, composite devices, vendor and product IDs against a known-device list, serial number present or missing, descriptor strings that do not match the vendor
- Hidden-interface rule: storage plus HID, storage plus network, or storage plus serial is refused; the user sees the interfaces by name and can override only for a device they recognise
- Power draw and enumeration behaviour recorded; repeated re-enumeration and class switching are flagged
Keystroke injection
- New HID keyboards are rate-limited for the first 30 seconds; typing above a human rate, or any typing before the user has touched the real keyboard, cuts the device off
- The injected text is captured and shown with the commands it was trying to run, and the device's identity is added to the local block list
- USB Killer notice: software cannot stop a high-voltage device; the tool recommends an opto-isolated USB isolator or a sacrificial powered hub for unknown hardware and shows which port to use
Image and detonate
- Sector image through the raw device handle; no file system driver touches the stick on the host; image hashed and stored in the quarantine folder
- Disposable Hyper-V VM from a clean snapshot (Desktop VM Studio), no network, clipboard off, image attached read-only; Windows Sandbox for a quick look when Hyper-V is not available
- Static pass: true type, double extensions, hidden files, autorun.inf, LNK targets, macros and OLE, scripts, installers, archives to depth, local signatures, optional hash-only VirusTotal lookup
- Dynamic pass: documents and installers opened in the VM with processes, files, registry and attempted connections recorded; the VM is discarded afterwards
Extract and report
- Content disarm and reconstruction for documents, PDFs and images; plain files copied after the checks pass; executables never copied out without an explicit choice
- Report with verdict, evidence, timeline and a sendable summary; results also in Reports and alerts in Security Nudge for the household or office
- Always-armed test-station mode for IT with a device allow-list, and a monthly summary of refused devices
Who it is for
Accountant
A stick from a client
A client hands over a USB stick of invoices. Quarantine images it, finds a macro in one spreadsheet that would have downloaded a payload, rebuilds the spreadsheets without macros, and the accountant sends the client the one-page report.
Developer
The conference giveaway
The free 'memory stick' presents a hidden keyboard interface. It is refused before Windows sees it; the device identity goes into the report and the block list.
Technician
A repair shop's intake bench
Every customer drive is opened on the always-armed bench PC; the shop keeps the reports and has never had a stick infect a workstation.
Benefits
- Open an unknown USB stick without it touching your PC
- Attack devices disguised as memory sticks are refused by name
- A report of what the stick would have done, and clean copies of the files you wanted
Built to be trusted
- The host never mounts the file system of a quarantined device
- Analysis VMs have no network and are discarded after every run
- Verdicts say 'no bad behaviour observed', never 'safe'
- Every refused device and every extracted file is logged with hashes
Good to know
Software cannot protect a port from a USB Killer; that needs a hardware isolator or a sacrificial hub, and the card says so. Malware that notices it is in a virtual machine can stay quiet, so the verdict is about observed behaviour, not a guarantee. Hyper-V and Windows Sandbox need Windows Pro or better; on Home the quick engine falls back to static analysis only. The driver-level hold is the strongest part and the hardest: the first release holds devices through Windows device-installation policies, and the signed filter driver comes later. The keystroke guard can briefly block a legitimate fast macro pad until it is allow-listed. Devices plugged in while Quarantine is off are treated like any other by Windows.
Under the hood
For technical readers
- Device-installation policies and PnP management first, a signed USB filter driver later
- Raw device I/O from USB Lab; virtdisk VHD attach
- Hyper-V disposable VMs (Desktop VM Studio) and Windows Sandbox
- File, archive and document parsers; CDR pipeline; local signatures; VirusTotal hash API (optional)
- Reports, alerts (Security Nudge), Jobs