Tracking Lost USB Flash Drives with Honeytokens: Incident Analysis, Token Reliability, and a System for Instrumenting Existing Files

Lost USB flash drives remain a steady source of personal-data incidents, and the organization that loses a drive usually cannot tell whether anyone has opened the files on it. We study whether honeytokens, which raise an alert when a file is opened, can remove part of that uncertainty. The paper makes three contributions. First, we analyze 300 publicly reported loss incidents from 2005 to 2024 and find that schools and universities (97 cases) and hospitals (76 cases) account for more than half of them. Second, we test ten Canarytokens token types on macOS, Windows 10 and Windows 11, with and without security software: Word and Excel tokens alerted in every environment, whereas PDF and executable tokens were unreliable or were blocked. Third, because the public service can only issue new template files, we build a self-hosted system that embeds a token into a user's existing Excel workbook and collects every alert in a searchable log. In a preliminary evaluation with four participants and 16 file openings, every opening raised an alert whose timestamp matched the recorded opening time to the minute. HTTP tokens located the opener to the correct prefecture or municipality in 6 of 8 openings; DNS tokens did so in none. We discuss what these results do and do not show, and what remains to be evaluated.