Can a Plugged-In Device Read Your Memory?

Yes, in the specific case that matters: a device connected to a port that carries PCI Express can be granted direct memory access, and DMA lets it read or write main memory without the operating system handling each byte. Whether it actually can on your machine depends on the port, on whether the machine was locked, and on whether the platform enforces an IOMMU boundary. A plain flash drive on an ordinary USB port cannot do this; the exposure lives on ports that carry the PCI Express fabric.

This guide assumes a device you did not expect was connected to a machine you trust: a found drive, a borrowed dock, a charger that turned out to be more than a charger. It covers what such a device can reach, which ports matter, and what to note down before anything is unplugged.

What is DMA and why does it matter after a suspicious device was connected?

Direct memory access is the mechanism that lets hardware move data to and from RAM without the processor touching every transfer. It exists so fast devices do not stall the CPU, and every internal disk controller and graphics card relies on it. The same mechanism becomes a problem when an untrusted device is granted it: a DMA-capable peripheral can, in the worst case, read memory that holds unlocked keys, session tokens or open documents, and the operating system may not log the reads.

What the device can reach is decided by the tree it is plugged into. Machines organise PCI Express as a root complex with root ports, switches and endpoints, and the address space a device may touch follows that structure. The PCI Express topology reference at Root Complex maps those roots, ports and endpoints from the public specifications, which is the right level of detail for understanding what a port can expose. Where an IOMMU is enforced, the tree is unchanged but the device is confined to the regions the platform allows.

Which external ports expose the PCI Express link?

Thunderbolt and USB4 ports are the common case: they tunnel PCI Express, which is exactly why they are fast and exactly why they are sensitive. PCIe card slots, ExpressCard on older laptops, OCuLink and some M.2 positions also carry the fabric, though most of those require opening the machine. An ordinary USB port that does not carry USB4 or Thunderbolt gives a device no DMA path, so a simple flash drive is a different and mostly lesser problem.

Modern systems can restrict this access. Microsoft documents Kernel DMA Protection for Thunderbolt, the platform feature that keeps a newly attached device out of memory until conditions are met, and current macOS and Linux builds enforce similar boundaries. The useful check is whether the protection is enabled on the machine in question, which is why the exact port and the machine's lock state matter more than the device's branding.

What should you record before unplugging anything?

1. 01
   Photograph the setup as found

   Which port the device sits in, any branding or serial marking, the cable routing, and whether the machine was powered, locked or asleep.

2. 02
   Note times and changes

   When the device was first noticed, who connected it if that is known, and anything the machine did afterwards: new prompts, fan behaviour, restarts, or peripherals acting differently.

3. 03
   Do not inspect it on a second machine

   Plugging the device into another computer to see what it is can extend the problem. Identification and imaging belong to whoever handles the incident.

What limits the exposure

A locked machine with enforced DMA protection leaves a newly attached device far less room than an unlocked session. If the event concerns a work machine or shared data, hand the record to the responsible team rather than improvising, and keep the device as found. Once the record exists, unplugging is reasonable; the note is what makes the next decision possible.