Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to make sure that my working environment is contained (prevent data leaks meaning I don't want temp file or traces from files I have worked on). I am about to create a usb key with the full disk encryption provided by Ubuntu. Knowing that I will edit files stored on that key and I will not allow any other access (no network no nothing)...

Can I assume that this environment is contained ? From what I know the data I am going to work on will be uncrypted in RAM but else pretty safe...

share|improve this question
up vote 3 down vote accepted

When you boot off a USB disk, and use only files from the USB disk, then you are safe from interference from any other operating system which may reside on the machine hard disk.

However, if the machine hardware is hostile, then you won't be protected. Hardware key loggers work regardless of the booted operating system. Malicious BIOS code may also make nasty things; BIOS code is executed before your OS is loaded from the USB drive, so there is nothing your OS may do to really defend itself against an evil BIOS.

And let's not forget the classic "thinking out of the box" methods, e.g. someone 100m away with a telescope, zooming on your screen and reading everything that you read yourself (for a trickier but funnier method, the telescope zooms on your glasses and observes the reflection of the screen). Or reconstructing what you type on the keyboard, using a mere sound recorder under the table (in any keyboard, each key makes a slightly distinctive sound, sufficiently distinct to allow for ulterior reconstruction of what you type). If you are serious about security, then environment matters.

share|improve this answer
Sure but I mean, should somebody get my computer and my usb key without the password, can he find traces of files ? – statquant Oct 7 '13 at 14:41
Normally. Except with "cold boot attacks": when a computer is shut down, the RAM contents can still be preserved from some second or minutes, especially if the chip temperature is drastically lowered. After two or three minutes after shutdown at room temperature, the RAM contents are gone for good. Speaking of which, beware of sleep/hibernation modes -- when you shut the machine down, you really want a shutdown. – Thomas Pornin Oct 7 '13 at 14:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.