> It had someone's pictures on it, but no identifying information, so I had no way of returning it.
You could hav put your laptop on a network with heaps of monitoring going on, and then mailed it back to NSA/GRU/MSS/Mossad as required based on the ip addresses your machine started connecting to...
;-)
Thankfully random SD cards should be much safer than random USB devices, but it's probably better to be careful.