Will editing a Word file from a mounted Truecrypt volume leave any trace behind on the host computer?

Question

I've heard that even if you have a Word document encrpyted (just using the built in Word encryption tools) and are editing it, it can still leave behind remnants of a file on the local computer in either hidden files or a cache somewhere. I'm not sure if that's even true or not, just something i thought I heard somewhere.

So my question is, when editing documents, such as a Word file, from a mounted Truecrypt volume, does it leave any cache or 'residue' behind on that computer giving any info about the document?

Answer 1

As you can see here the proper answer is "sometimes" but given you count on your document being private you shouldn't assume the behavior of Word is safe.

If you really want to protect your encrypted documents you must use the full disk encryption because there are too many case where your OS/apps will cache data on disk (swap, temp files, filename in the registry as recent documents, hibernation...).

Answer 2

This is a very old thread, but I thought I'd throw in my two cents-- two cents based on direct experimentation.

Word as an application (only one of of many) can and might leave traces of edited documents that you work from a truecrypt or Veracrypt volume. After working on a Word document for many weeks directly from a secure file container in Veracrypt, I used a tool called "Recuva" to scan for deleted files on my C: drive and scanned for text strings that I knew were unique to the document I'd been working on.

Recuva found a file fragment in 'poor' condition which had been 'overwritten' by a log file in Windows/System -- the exact name and details not important.

I did a file recovery and inspected the contents. It was full of fragments of other files, but within the restored file contained large fragments of the document I'd been working on.

Now, there are many possible reasons for this. The important thing is to the best of my knowledge, I'd never moved the file off the encrypted volume, I'd never saved it locally. My best guess is it was an autorecover which was deleted from the C: drive after a successful save and close. But the exact reasons aren't as important as the mere fact that working on documents of any type from a mounted truecrypt/veracrypt volume may leave traces of themselves through whatever mechanism the particular software uses to cache, save copies or recover themselves outside of the mounted volume. As the poster above said, your BEST bet is total disk encryption.

Answer 3

Yes, MS Word creates several temporary copies, and links to files. Never assume any application is not going to leak at least some information through such accidental things. But when it comes to windows you also have recently used documents lists and the like.

Answer 4

It is easy to test your system to see if anything was left behind you could open the word file from the encrypted drive, and I think that is a lot better than taking someone's word.

Modify the file on the encrypted drive, and then do a find in files for any of the text within the file. Ideally you would use grep to perform the find in files, which is binary safe.

The BTK Killer was caught by inspecting the metadata of a word file. Although that is the opposite of what you asked.