---
{
  "title": "Exfiltration Over Physical Medium",
  "summary": "Physical-medium exfiltration moves information out through storage or another physical device.",
  "topic": "networking",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    2
  ],
  "aliases": [
    "T1052"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1052: Exfiltration Over Physical Medium",
      "url": "https://attack.mitre.org/techniques/T1052"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Physical-medium exfiltration moves information out through storage or another physical device. Network monitoring may not observe this transfer.


## An investigation example

An employee endpoint copies sensitive files to an attached device during an otherwise suspicious collection sequence.

## Evidence to examine

Review device identity, attachment history, file copy evidence, access policy, and physical custody records where available.

## A common analytical pitfall

Device insertion alone does not prove copying, and absence of gateway traffic does not rule out physical transfer.

## Response considerations

Preserve device and host evidence through authorized procedures and assess the data actually copied rather than the drive's theoretical capacity.


## Physical movement can cross the information boundary

Data can leave an environment through removable storage or another physical carrier rather than a network connection. The security question concerns what information was copied, who had authority, and where the carrier went. A lack of outbound network traffic does not exclude every possible data-loss path.

Device attachment is only one stage. File reads, writes to the carrier, successful completion, and physical removal each support different claims. Approved transfers, backups, and classroom workflows can produce similar technical events. Evaluate context and authorization before describing the activity as theft.

## A fictional external-drive copy

An academy's logs show a restricted folder being read while an external drive is attached. Analysts examine file-service and endpoint evidence to determine whether relevant data was actually written to the drive. The timing alone is not sufficient. They also review approved work and preserve device identifiers where the source supports them.

A later inspection of a drive may show current content but not every earlier state. Deleted or overwritten material, multiple users, and incomplete metadata can complicate attribution. Handle the device through the appropriate evidence procedure and avoid altering it during casual inspection. Business and privacy decisions should use a bounded account of the evidence.

## Distinguish four stages

Create fictional events for attachment, source-file access, destination-file creation, and device removal. Write the claim supported by each and identify the missing link if one stage is absent. Then compare an approved export with an unauthorized one. Use harmless training records rather than copying sensitive information.

Controls should fit legitimate needs as well as risk. An organization may approve particular transfer routes, restrict writable devices, or require records of sensitive exports. No single control automatically answers every scenario. The useful skill is tracing the actual information path and verifying which boundary the organization intended to enforce.

## Related concepts

- [[packet-analysis]]
- [[exfiltration]]
- [[network-segmentation]]