---
{
  "title": "Communication Through Removable Media",
  "summary": "Removable-media communication relays commands or results through physical storage between compromised systems.",
  "topic": "networking",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    2
  ],
  "aliases": [
    "T1092"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1092: Communication Through Removable Media",
      "url": "https://attack.mitre.org/techniques/T1092"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Removable-media communication relays commands or results through physical storage between compromised systems. Disconnected networks can still have indirect information paths.


## An investigation example

An isolated workstation and a connected host repeatedly exchange small changing files through a reused device.

## Evidence to examine

Examine file versions, device custody, insertion history, and related execution on both systems.

## A common analytical pitfall

Removable storage movement can be legitimate; repeated transfers require evidence of unauthorized command or data handling.

## Response considerations

Preserve the exchange sequence and review media controls without assuming network isolation alone prevented communication.


## A control message need not cross a live network

Removable media can carry information between systems that do not communicate directly. In a command-and-control context, the media may transport instructions or results as it moves between devices. This differs from simply copying valuable data onto a drive for removal. The role of the content and the sequence across hosts matter.

Ordinary file exchange and maintenance also use removable storage. Investigators should identify device context, mount or attachment events, file operations, process activity, and authorized workflow. A drive being present does not prove that it carried commands or that every connected host was affected.

## A fictional disconnected training system

An academy uses removable media to move approved course material to an isolated lab. During an investigation, analysts find unexpected files created on the media by one host and read by an unfamiliar process on another. They preserve relevant device and file records and examine the content through an approved analysis route.

The relationship may be difficult to reconstruct because clocks, device identifiers, and retention differ across hosts. Document those limitations and distinguish a plausible transport path from demonstrated execution. Do not connect unknown media to a personal computer to inspect it casually; handling should follow the authorized evidence procedure.

## Map a two-host sequence

Using fictional records, draw a drive moving from host A to host B and back. Label attachment, file creation, file read, and process events separately. State what evidence would support a command-and-result relationship rather than ordinary document exchange. A paper scenario or prepared training image is sufficient.

Defensive planning should consider approved transfer processes, device handling, and monitoring where appropriate. A disconnected network boundary reduces some paths but does not remove every information flow. Understand the actual media workflow before making broad claims that isolation alone guarantees no communication can occur.

## Related concepts

- [[packet-analysis]]
- [[exfiltration]]
- [[network-segmentation]]
- [[replication-through-removable-media]]