> For the complete documentation index, see [llms.txt](https://documentation.hak5.org/hak5-usb-rubber-ducky/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.hak5.org/hak5-usb-rubber-ducky/advanced-features/storage-activity.md).

# Storage Activity

## Overview

Storage activity is an experimental feature which may be used to detect whether or not the storage device, when using `ATTACKMODE STORAGE` is in use. This can be helpful when performing USB exfiltration. It can also be used to determine whether the storage device has been activated, useful for VID and PID enumeration.

{% hint style="info" %}
Results may vary greatly depending on target OS. Some operating systems may keep storage active for an exceptionally long time.
{% endhint %}

## WAIT\_FOR\_STORAGE\_ACTIVITY

The `WAIT_FOR_STORAGE_ACTIVITY` command blocks all further payload execution until activity on the USB Rubber Ducky storage has been detected.

### Example

```
REM Example WAIT_FOR_STORAGE_ACTIVITY Payload

ATTACKMODE HID STORAGE
DELAY 2000
LED_OFF
STRINGLN Waiting for the disk to be read from or written to...
$_STORAGE_ACTIVITY_TIMEOUT = 10000
WAIT_FOR_STORAGE_ACTIVITY
LED_OFF
LED_R
```

#### Result

* The LED will light red after storage activity has been detected.

## WAIT\_FOR\_STORAGE\_INACTIVITY

The `WAIT_FOR_STORAGE_INACTIVITY` command blocks all further payload execution until the storage device is determined to be inactive.  

### Example

```
REM Example WAIT_FOR_STORAGE_INACTIVITY Payload

ATTACKMODE HID STORAGE
DELAY 2000
LED_OFF

GUI r
DELAY 100
STRING powershell "$m=(Get-Volume -FileSystemLabel 'DUCKY').DriveLetter;
STRINGLN echo $env:computername >> $m:\computer_names.txt" 

$_STORAGE_ACTIVITY_TIMEOUT = 10000
WAIT_FOR_STORAGE_INACTIVITY
LED_OFF
LED_R
```

#### Result

* The LED will light red when the storage device becomes inactive.

## Internal Variables

The following internal variables relate to storage activity and may be used in your payload for advanced functions.

### $\_STORAGE\_ACTIVITY\_TIMEOUT

As payload is running, this value decrements if storage activity is not detected.

Default value is 1000.