Physical Data Exfiltration

This technique copies local data to removable physical media for later physical transfer or use in an air-gapped workflow. This Windows-focused record contains two alternative transfer procedures: enumerate files under an approved source root, archive one selected file with 7-Zip, then copy that archive to an approved mounted volume; or copy an authorized directory tree directly with Robocopy. Choose one transfer procedure. The direct-copy method has no file or directory filters and includes empty subdirectories. An optional PnP query can list present USB devices, but it does not prove an entry is removable storage or identify its mounted path. A local copy does not prove the media was removed or the data accessed elsewhere.