Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If I have an encrypted RAR file which will only open using a password, and I opened a file directly from within WinRAR by double clicking the file inside WinRAR, I assume that WinRAR will create a temporary version somewhere in the drive (temp folder?) before opening it using the default application assigned by the user in the system.

Does WinRAR make sure to delete all traces of the file once the archive is closed? or will it keep the temp file somewhere in the file system?

share|improve this question
1  
Your assumption is correct, Winrar creates a temporary version. I don't know about the rest. But even assuming that Winrar deletes the traces, they physically remain on your drive and might be retrieved (Like any deleted file) Unless Winrar is doing something sophisticated. –  Hello World May 12 at 5:25
    
If you're really paranoid, extract your Archive to a ramdisk and manually delete the files when done. –  Hello World May 12 at 5:26
    
Can you be sure that extracting to a ramdisk or to a Truecrypt image does not result in temporary files elsewhere? –  SPRBRN May 12 at 8:20
3  
@SPRBRN You don't need to trust anyone's claims here, or even WinRAR's own documentation (if it has any on this topic) - you can check yourself with Process Monitor. –  Iszi May 12 at 13:46

1 Answer 1

up vote 39 down vote accepted

Very good question. Yes, by default, WinRAR leaves traces of temporarily extracted files.

WinRAR does indeed create temporary files when opening them directly from the archive. It also performs a normal deletion once WinRAR is closed. However, deleted files do physically stay on the disk after you delete them. Normal delete operations only delete the file from the filesystem index.

Think of it like trying to remove a page from a book by striking its title from the index page - the page stays in the book.

WinRAR has a nice feature that securely wipes (removes the index, and the page itself from the book) temporarily extracted files after WinRAR is closed. By default, this feature is turned off. You can turn it on from the security settings window.

winrar-secure-wipe

By default, it's set to 'Never', you don't want that. The option 'Always' securely wipes all temporarily extracted files, while the option 'Encrypted only' wipes temporarily extracted files only if they belong to an encrypted archive.

Important notes: WinRAR will also create temporary files when extracting files by dragging them to the destination. However, using the "Extract here" option doesn't create temporary files.

As mentioned below, it's also important to make sure that you don't close WinRAR before closing your file. I've just tested this behavior a Microsoft Word document and a PDF file. The .docx file persisted in the temp folder, while the .pdf file was wiped as soon as WinRAR was closed. So make sure you understand that this behavior isn't very reliable if you close WinRAR or if it crashes.

share|improve this answer
3  
However, using the "Extract here" option doesn't create temporary files. (I'm 99% sure about this, I'll verify and edit) - I can verify this, as I use this option when my SSD (where all tmp goes) is out of space. –  Zsolt Szilagy May 12 at 15:12
9  
It's also questionable what happens if WinRAR crashes before deleting (unlikely, but possible) or if the program you opened the file in is still open and has a lock on it when WinRAR is closed (more likely). –  Bob May 12 at 15:20
    
@Bob Indeed. I've just tested it and in some cases the file was kept in the temp folder. –  Adnan May 12 at 21:51
    
@Bob this blows the whole concept of security when it comes to temp file being held as a prisoner by a program. I also assume that there is no native windows API that WinRAR can use to tell windows to delete the file as soon as it is free :/ –  MeNoTalk May 13 at 1:30
    
@MeNoTalk Another issue is if the computer loses power or otherwise crashes (bluescreen?). Then the only hope would be if WinRAR remembered and wiped on next start (I don't think it does). In general, putting unencrypted temporary files on disk is a bad idea - it's much safer to only keep them on a (transparently) encrypted file system, or in RAM. There's also the issue of the opening program making its own temporary/working copy (I believe MS Office does this). –  Bob May 13 at 2:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.