Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite

I've heard that even if you have a Word document encrpyted (just using the built in Word encryption tools) and are editing it, it can still leave behind remnants of a file on the local computer in either hidden files or a cache somewhere. I'm not sure if that's even true or not, just something i thought I heard somewhere.

So my question is, when editing documents, such as a Word file, from a mounted Truecrypt volume, does it leave any cache or 'residue' behind on that computer giving any info about the document?

share|improve this question

3 Answers

up vote 6 down vote accepted

As you can see here the proper answer is "sometimes" but given you count on your document being private you shouldn't assume the behavior of Word is safe.

If you really want to protect your encrypted documents you must use the full disk encryption because there are too many case where your OS/apps will cache data on disk (swap, temp files, filename in the registry as recent documents, hibernation...).

share|improve this answer
up vote 1 down vote

Yes, MS Word creates several temporary copies, and links to files. Never assume any application is not going to leak at least some information through such accidental things. But when it comes to windows you also have recently used documents lists and the like.

share|improve this answer
I'd expect a used documents list to only reveal the document title, which is not always a concern. Or is there more? A preview? Indexing of contents by a search service? – Gilles Jan 6 '12 at 17:58
Microsoft Office products tend to use an "autorecover" feature that will leave copies of edited documents on the drive for a temporary period. The contents may linger on the drive past the time that the (references to) files are deleted. – Jeff Ferland♦ Jan 6 '12 at 18:10
The recent documents list normally only leaks the filename AND PATH of the document. The path will include the drive letter which will then show the document was on either removable storage or a truecrypt volume or something similar. – pipTheGeek Jan 6 '12 at 18:11
Path, last access time, last modified time and shared metadata. – ewanm89 Jan 6 '12 at 22:58
Just wiping all the timestamps in windows when a single file is modified is not easy. – ewanm89 Jan 6 '12 at 22:59
up vote 0 down vote

It is easy to test your system to see if anything was left behind you could open the word file from the encrypted drive, and I think that is a lot better than taking someone's word.

Modify the file on the encrypted drive, and then do a find in files for any of the text within the file. Ideally you would use grep to perform the find in files, which is binary safe.

The BTK Killer was caught by inspecting the metadata of a word file. Although that is the opposite of what you asked.

share|improve this answer
1  
I disagree that it is “easy to test your system to see if anything was left”. There will probably be changes in some data files (including the Windows registry); how do you propose to ensure that none of these changes are related to the Word document? – Gilles Jan 6 '12 at 18:01
@Gilles Oah right windows registry. Okay then mount it with linux and do a grep -a -R and search from some text in the file and another search for the file name. That is a lot better than asking someone that sounds convincing somewhere on the internets. – Rook Jan 6 '12 at 18:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.