Imagine if you were a malicious actor and you wanted a copy of all photos someone plugged into a computer that were not things like browser cache, just good honest to god OC.

All you have to do is listen on drive letters D, E, F, G and when one is plugged in with a DCIM directory… silently upload the data contents to a server over the internet when a drive is detected with that subdirectory.

Have you ever wondered why you couldn’t eject a drive without rebooting? It’s not like it’s going to tell you what process is keeping it locked… Encryption wouldn’t even matter, because you’re gonna need to decrypt/unlock it to access it, and windows doesn’t care what service or application is trying to access it, it is glad to allow any kind of file action without even admin rights.

Anywho, actor has your photo, AI trivially builds facial recognition models, pulls in timestamps, geolocation metadata, camera metadata… and now those photos you never intended to upload anywhere are in a database of PII that will be shared to god-knows-who.