On a theoretical level you need to first compare the layout of the electronics of the device with the intended schematic (you probably don't have) or another known good version of exactly the same drive. If it differs, find out what differs and what are the consequences? Are there any new "smart" parts like a micro-controller? What is it connected to? Then you take a look at all the programmable electronics on there and dump the binary code in there. (using JTAG, SPI, whatever you need). Then you compare this binary code with the known-good version (you probably don't have) or versions dumped from known-good versions of this drive. You then exactly analyze the differences by disassembling the code and understanding what it does. Is it just a bugfix/update by the manufacturer or malicious code? You can look [at this blog][1] for some nice potographs and a description how changing the drive firmware works. If you determined that the hardware and firmware hasn't been tampered with, you can continue with the data on the drive. Data on the drive isn't executed unless the UEFI/BIOS/... or operating system does so. So first you need to check the bootloader on there. Does the drive contain a bootloader? if yes, see if it is a known good bootloader (e.g. WindowsBootloader, default grub, ...). If not, disassemble the code and analyze it. If you are sure that the hardware, firmware and bootloader are not malicious, the only way to execute code would be your operating system. Find out if your OS automatically loads and executes code from connected drives (it shouldn't) and if so, from where exactly. See if there is code in this locations on your drive. Analyze it. If you came this far, there is no malicious code on the drive that is automatically executed. Of course, there still could be malicious code that doesn't run automatically. [1]: http://spritesmods.com/?art=hddhack&page=3