A writer for Sophos' blog Naked Security purchased and tested 'lost' USB drvies. He found 66% were infected with malware and many contained important information.
