7

I've heard that even if you have a Word document encrpyted (just using the built in Word encryption tools) and are editing it, it can still leave behind remnants of a file on the local computer in either hidden files or a cache somewhere. I'm not sure if that's even true or not, just something i thought I heard somewhere.

So my question is, when editing documents, such as a Word file, from a mounted Truecrypt volume, does it leave any cache or 'residue' behind on that computer giving any info about the document?

7

As you can see here the proper answer is "sometimes" but given you count on your document being private you shouldn't assume the behavior of Word is safe.

If you really want to protect your encrypted documents you must use the full disk encryption because there are too many case where your OS/apps will cache data on disk (swap, temp files, filename in the registry as recent documents, hibernation...).

2

This is a very old thread, but I thought I'd throw in my two cents-- two cents based on direct experimentation.

Word as an application (only one of of many) can and might leave traces of edited documents that you work from a truecrypt or Veracrypt volume. After working on a Word document for many weeks directly from a secure file container in Veracrypt, I used a tool called "Recuva" to scan for deleted files on my C: drive and scanned for text strings that I knew were unique to the document I'd been working on.

Recuva found a file fragment in 'poor' condition which had been 'overwritten' by a log file in Windows/System -- the exact name and details not important.

I did a file recovery and inspected the contents. It was full of fragments of other files, but within the restored file contained large fragments of the document I'd been working on.

Now, there are many possible reasons for this. The important thing is to the best of my knowledge, I'd never moved the file off the encrypted volume, I'd never saved it locally. My best guess is it was an autorecover which was deleted from the C: drive after a successful save and close. But the exact reasons aren't as important as the mere fact that working on documents of any type from a mounted truecrypt/veracrypt volume may leave traces of themselves through whatever mechanism the particular software uses to cache, save copies or recover themselves outside of the mounted volume. As the poster above said, your BEST bet is total disk encryption.

1

Yes, MS Word creates several temporary copies, and links to files. Never assume any application is not going to leak at least some information through such accidental things. But when it comes to windows you also have recently used documents lists and the like.

  • I'd expect a used documents list to only reveal the document title, which is not always a concern. Or is there more? A preview? Indexing of contents by a search service? – Gilles Jan 6 '12 at 17:58
  • Microsoft Office products tend to use an "autorecover" feature that will leave copies of edited documents on the drive for a temporary period. The contents may linger on the drive past the time that the (references to) files are deleted. – Jeff Ferland Jan 6 '12 at 18:10
  • The recent documents list normally only leaks the filename AND PATH of the document. The path will include the drive letter which will then show the document was on either removable storage or a truecrypt volume or something similar. – pipTheGeek Jan 6 '12 at 18:11
  • Path, last access time, last modified time and shared metadata. – ewanm89 Jan 6 '12 at 22:58
  • Just wiping all the timestamps in windows when a single file is modified is not easy. – ewanm89 Jan 6 '12 at 22:59
1

It is easy to test your system to see if anything was left behind you could open the word file from the encrypted drive, and I think that is a lot better than taking someone's word.

Modify the file on the encrypted drive, and then do a find in files for any of the text within the file. Ideally you would use grep to perform the find in files, which is binary safe.

The BTK Killer was caught by inspecting the metadata of a word file. Although that is the opposite of what you asked.

  • 1
    I disagree that it is “easy to test your system to see if anything was left”. There will probably be changes in some data files (including the Windows registry); how do you propose to ensure that none of these changes are related to the Word document? – Gilles Jan 6 '12 at 18:01
  • @Gilles Oah right windows registry. Okay then mount it with linux and do a grep -a -R and search from some text in the file and another search for the file name. That is a lot better than asking someone that sounds convincing somewhere on the internets. – rook Jan 6 '12 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.