1

If you decrypt ciphertext to the terminal like this:

gpg --output - --armor --encrypt --recipient 23642351 message.txt.pgp

..does it touch the hard drive / ssd or only live in RAM?

What about when Thunderbird decrypts a message - does the plaintext touch the hard drive or only live in RAM?

Thunderbird stores everything encrypted with your own public key even copies of the sent mail which went out encrypted with other people's public keys, and it lets something live for five or ten minutes as plaintext before it will ask you for the password to your private key again to view something. The question is, during those five or ten minutes, has it saved it as plaintext on the hard drive?

I know from recovering text files from the hard drive that anything you delete stays floating around on there for a while whereas anything in RAM will disappear the moment the power is switched off.

Improve this question
5
  • 1
    I would not rely too much on what specific applications do regarding temporary files. I would also not rely on information in RAM to be immediately lost after switching off because of memory paging. Better (also) use full disk encryption.
    – Steffen Ullrich
    Commented Jun 29, 2021 at 8:13
  • 2
    Even if the decryption stores the plaintext in RAM, plaintext could be written to the hard drive inadvertently if there is swapping.
    – mti2935
    Commented Jun 29, 2021 at 8:14
  • Thanks, I am switching to encryption for the user folder partition. Not sure if the system partition needs it, and the 'swap' partition which is there for hibernating might be used for RAM swapping. I think you can switch off RAM swapping. At one point I did this to keep /tmp in RAM. There are commands like swapoff -a which will switch that off completely, but I think the RAM will only spill onto the hard drive if it gets full which is rarely in my case. Question is, does Thunderbird or the terminal save to hard drive.
    – cardamom
    Commented Jun 30, 2021 at 17:08
  • I assume you meant to use the --decrypt/-d flag there, rather than --encrypt --recipient?
    – CBHacking
    Commented Jan 29 at 6:24
  • @CBHacking yes looks like it, about decrypting message.txt.pgp not encrypting it and whether the plaintext that then shows in the terminal gets saved anywhere.
    – cardamom
    Commented Jan 29 at 9:03

1 Answer 1

Reset to default
0

Most of it will stay in the RAM but there might be instances when it might touch the hard drive or SSD, mainly if you have complex data and or attachments.

Improve this answer
1
  • 1
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Dec 30, 2023 at 9:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .