If you open a password protected rar archive, enter the correct password, and then doubleclick (open) a textfile in to read the content:
is it in reality in the background written to the disk in some cache directory OR does everything stay in the RAM?
Example: User sometimes views a textfile (for example with his sensitive passwords) in a password protected rar archive. Then his laptop gets stolen. Although the attacker does not known the password to the rar file, he could still view the textfile with some recovery tools, because winrar temporarely wrote it to the disk to view it? So he could recover it?
Is a container with Veracrypt any different? Does it 100% stay in RAM there?
Thank you in advance for your answers!