microSD

The Secure Digital (SD) standard dates from 1999 and is maintained by the SD Association. One electrical interface covers three form factors: the original full-size SD card (32 x 24 mm) with a write-protect switch, the largely obsolete miniSD, and microSD. The microSD measures 11 x 15 x 1 mm and has eight contact pins.

microSD started in 2004 as TransFlash, a phone format that joined the SD family in 2005. Today it dominates compact devices: smartphones, cameras, drones, dashcams, single-board computers, and IoT hardware. It is one of the most common removable media, and for data protection one detail matters most. A microSD card has no write-protect switch, so nothing on the card itself stops writing.

The markings printed on a card describe a guaranteed minimum sequential write speed. They do not describe the peak read speed on the marketing label.

The Application Performance Class (A1, A2) guarantees random performance for apps running directly from the card. Bus interfaces set the ceiling. UHS-I reaches about 104 MB/s, and SD Express adds PCIe and NVMe lanes for speeds in the gigabytes-per-second range. Even an ordinary UHS-I card moves gigabytes in minutes.

The four families differ in capacity and file system. A card works only in a host that supports its family. An SDXC slot usually refuses an SDUC card, and very old readers stop at SDHC.

SD (SDSC) is the original Standard Capacity family, up to 2 GB, formatted with FAT12 or FAT16. SDHC covers 2 to 32 GB with FAT32, and nearly every host can read it. SDXC covers 32 GB to 2 TB with exFAT, the common range for modern cards. SDUC, introduced in 2018, covers 2 to 128 TB and needs a host that supports it.

A microSD card almost never connects directly. The passive full-size SD adapter is a plastic carrier that maps the card's pins to the larger footprint. It has no electronics and ships with nearly every card.

A microSD in an adapter inherits the universality of full-size SD, so any laptop or camera with a slot can read it. The card is not a device class of its own. Controls that address only one path miss the others.

1. 1

   Adapter

   The card goes into a passive adapter that maps its pins to the full-size SD footprint.

2. 2

   Slot or reader

   The adapter goes into any SD slot, USB reader, or dock.

3. 3

   Operating system

   The card appears as an ordinary storage volume. A USB reader enumerates as generic USB mass storage.

4. 4

   Phone path

   A connected phone may expose the card over MTP instead.

The traits that make microSD convenient, namely minimal size, high capacity, and universal readability, also make it attractive as a data exfiltration channel. The medium itself is not hostile. It is legitimate storage in cameras and phones. The risk is unmanaged use: a gigabyte-scale write channel on any endpoint with a reader.

The card is easy to hide, carry, or leave inside a personal phone, where it looks like ordinary internal storage. Commercial cards hold up to 1 TB, enough for a whole document repository or customer database in one transfer. Such transfers are visible to endpoint DLP on the workstation where the write happens.

Copying to a card is local. There is no network traffic and no cloud log for perimeter monitoring to see. The channel works offline, including in air-gapped environments, a documented vector in classified-network incidents. Cards are easy to misplace and rarely encrypted, so a lost card with personal data can be a reportable GDPR or HIPAA incident.

In Anexet DLP, the storage device settings sit in one place. The administrator decides whether storage devices are audited, whether file operations are logged, and whether each write is checked by content. The screenshot shows the three switches that together control a write to a microSD card.

Because the card always appears through a host device, control focuses on the endpoint where the write happens. Each layer answers a different question: which card is it, may it be written to, and what does the file contain?

USB and external drive control handles device identity and access. Content checks use digital fingerprints and sensitivity labels. The table shows what each layer does on its own.

Start with the channels that actually exist in your fleet: which workstations have card readers, and which phones connect over USB. Then write one rule for each. A rule that allows issued, encrypted cards and blocks everything else covers most cases without stopping routine work.

Logging matters as much as blocking. Even an allowed card needs a record of what was written to it, by whom, and on which device, so that a later investigation has evidence to work with.