I'm using a secondary drive to store encrypted files, in VeraCrypt file containers.
Unfortunately, even if the external drive is formatted as exFAT, Windows leaks information on files inside mounted VeraCrypt containers.

enter image description here

The highlighted file has been created inside the external drive-hosted container.
Thus, how can I prevent this without entirely turning off the USN Journaling (if it's even possible...)?

  • The USN Journal isn't leaking anything about the file on the encrypted drive. What you are seeing is evidence of a shortcut file that existed on your NTFS volume. If the information in that shortcut is sensitive, you have far bigger problems than the journal.
    – Ben Voigt
    Commented Jun 30, 2023 at 14:25

1 Answer 1


Windows has many default functions that are aimed at common use and support but can become problematic in a privacy/security context.

Not only your example in Journaling, but many other functions may be a concern as well. For example, external drive connections, such as Thumb Drives, often save drive identities and top level directory filenames in shellbags encoded into the registry. This content can persist long after the device is removed.

Once encrypted volumes are unlocked and mounted, all the standard Windows functions apply, including malware scanning, with copy/export if unknown executable, of the contents.

Simply plugging a thumb drive into a Windows machine will result in a hidden directory with a GUID (Globally Unique IDentifier) being written to the drive. To be fair, Mac's do this as well.

Along related privacy/security lines, encrypted PKzip files maintain a clear text list of all of the filenames in the archive. Note that 7zip does not do this.

In short, if you feel you need a higher level of privacy/security, you may want to re-evaluate your choice of operating systems or read Documentation >> System Encryption.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .