Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I often end up using netcafe's for browsing web (Windows 7).

I recently wanted to download some secure data from my gmail account on to the USB pen drive.

So, I went ahead and opened the attachment and copied it directly to the pen drive.

But now I am worried if any kind of backup or residue files may have been left on the PC I used.

I want to know what kind of information might have been left on the PC during the process. And is it possible to use this data to generate back the original file content from it?

The files copied comprised of .jpeg, .doc and .txt files.

share|improve this question
1  
Netcafe and security don't really blend that well... –  Lucas Kauffman Sep 10 '13 at 11:24
2  
Agreed - anyone in a position to inspect such residue would probably also be in a position to install software on the computer to simply make a copy of all downloads. If you don't own the hardware, you can't be sure of the software, so you can't guarantee privacy or security of at any level. –  cloudfeet Sep 10 '13 at 12:21
add comment

1 Answer

Assuming that the PC was "clean" (and that's a big "if"), then it partly depends on the Web browser. The file, while being downloaded, first goes through the buffers (in kernel RAM) associated with the socket. Then it is copied into the address space of the process which does the download, i.e. the Web browser. That browser then decides to have it written into some sort of file; this again entails sending the data into kernel space. The data goes to the file cache (the nominally unused physical RAM; the kernel uses it as temporary storage for data read from and written to disk), and finally to the disk which has been designated as target.

Internet Explorer, apparently (I just tried with IE 8.0), when downloading a file, will ask for the destination, and, crucially, will not download anything until the destination is chosen. When the data is obtained, it is sent directly to that disk. Firefox, on the other hand, begins the download as soon as you click on the link, and proceeds while you choose the destination. The file is temporarily written in an area meant for temporary files (on Linux it would be /tmp, but on Windows there is a per-user folder for that, see this page).

Therefore, with some Web browsers, a copy of your file made it at least temporarily to the hard disk of the computer. That file should have been deleted, but deletion does not imply wiping the data out from the physical medium; it just marks the used sectors as "reusable".

Another way your data may have leaked is through virtual memory. When the OS is short on physical RAM, it moves some of the data which is in RAM, into some swap area on the disk. It is hard to control which part of the RAM is used for that; the OS kernel will try to do that only with least recently used RAM, but this is heuristic. Since, with all browsers, the downloaded file makes it to the browser RAM space at some point, parts of the file data may have been copied into the swap files, thus to the physical medium.

To sum up, it is entirely possible that parts of your files still lurk on the hard disk of the machine you used. Some Web browsers make it more probable than others (note that while the Firefox behaviour implies more leaks, it also improves user experience, so this is not a case of obvious stupidity on the part of the Firefox developers).


The PC was not clean anyway. Or at least you should not assume it was clean. Machines which are left to usage to use by anybody, including ability to plug USB devices, might be riddled with malware. Such malware could be a key logger, and that key logger now has your... Gmail password ! At which point your files are not safe at all.

To make it simple: by accepting to use a netcafe machine for confidential data, you are already betting that you will get lucky, and the machine is "safe to use". Betting that whatever traces of your data remain on the machine will not be harvested by evil people, is not a significantly riskier bet. By using the machine in the first place, you pushed your luck quite far; pushing it a little bit further should not be that much an additional concern.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.