USB drives and old backups: the forgotten copies

Every office has one. It is the USB drive in the back of the desk drawer, dated 2017 in someone's handwriting, holding a copy of the client database from before the software migration. Nobody remembers the password, if there was one. Nobody wants to throw it away because it might be "the only copy." It is also exactly the kind of object that goes missing in a move, ends up in a donation box, or is carried out by someone on their way out of the company.

Removable drives and old backups are forgotten copies: data that was deliberately duplicated, then abandoned. Because they are not on any live computer, they are invisible to most routine cleanup. Here is a way to bring them under control.

Step one: take an inventory

You cannot manage what you have not counted. Set aside an hour and collect every piece of removable storage in the office. Check:

• Desk drawers, filing cabinets, the server closet, and the safe.
• Employees' bags, cars, and home offices, if people ever took work home.
• Old laptops and external hard drives sitting on shelves.
• Memory cards, CDs and DVDs, and any drive attached to a printer or scanner.
• Cloud backup accounts that nobody has logged into recently.

Record each item in a simple table: a label or number, what kind of device it is, who last used it, what it appears to hold, whether it is encrypted, and what you intend to do with it. Do the first look on a machine you trust, and treat the contents as sensitive from the first second. If the drive may hold client data, do not simply plug it into a random computer and browse; ask your IT provider how to inspect it safely.

Step two: decide, drive by drive

For each item, there are really three choices:

1. Keep and encrypt. If the contents are still needed under your retention schedule, copy them to a managed location, such as your encrypted backup system or the practice server, and either keep the drive only if it is encrypted or retire it.
2. Move, then wipe. If the data is needed but the drive is not, copy the data to the managed location, verify that it opens, and then erase the drive. Remember that a simple delete or quick format may not remove the data; see Secure deletion: what "delete" actually does to a file.
3. Destroy. If the contents are past their retention period, or you cannot verify them, physical destruction is the most dependable way to dispose of a drive. A destruction service can provide a certificate; keep it with your records.

If you cannot tell whether a drive holds anything important, resist the instinct to put it back in the drawer. Escalate the question to whoever owns the retention schedule, and check the contents with your IT provider. "We do not know what is on it" is a reason to act, not a reason to wait.

Labeling that helps instead of leaking

A label should help your own staff and tell a stranger nothing. Use an inventory number and a date, such as "Drive 07, installed [date]," and keep the key (what each number holds and who owns it) in the inventory table. Avoid writing client names, the word "passwords," or "tax returns" on the outside. Add an "expires" or "review by" date so the drive is not forgotten again.

Backup rotation that actually expires copies

Most offices think carefully about making backups and not at all about retiring them. A workable rotation has these elements:

• A written backup set. Which systems are backed up, where the copies go, how often, and who checks that they ran.
• An expiry rule. Old backups are deleted or destroyed on a schedule that fits the longest retention period of anything on them. If a backup must be kept for a long time, move only the necessary records to an archive instead of keeping every full copy forever.
• Offsite and encrypted. At least one copy should be stored away from the office, and encrypted, so a theft or fire does not take everything at once.
• A restore test. A backup you have never restored is a hope, not a backup. Test a restore at least once a year.
• Disposal logging. When a drive or backup set is retired, record what, when, how, and by whom.

A routine to keep it under control

1. Twice a year, review the inventory table and update it.
2. Check each item against the retention schedule and mark it keep, move, or destroy.
3. Rotate backup media on the written schedule and expire old sets.
4. Run one restore test per year and record the result.
5. Add any new USB drive, memory card, or external disk to the inventory on the day it arrives.
6. Include returning removable media in your offboarding checklist.

Finding what you forgot

MyVaultMate can scan external and USB disks that you choose to include and report whether they contain sensitive data such as Social Security numbers or card numbers, which helps you decide what to prioritize. It does not open zip files or backup archives; those are listed as “Not scanned”, so check them by hand. It reads supported file types only, moves or deletes nothing on its own, so the decisions above remain yours. You can see what a report looks like at /sample, or start a 14-day trial at /trial/ (a card is required and never charged automatically: the 14 days start at your first computer, and you choose a plan when they end).