Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm using a secondary drive to store encrypted files, in VeraCrypt file containers.
Unfortunately, even if the external drive is formatted as exFAT, Windows leaks information on files inside mounted VeraCrypt containers.
The highlighted file has been created inside the external drive-hosted container.
Thus, how can I prevent this without entirely turning off the USN Journaling (if it's even possible...)?
Windows has many default functions that are aimed at common use and support but can become problematic in a privacy/security context.
Not only your example in Journaling, but many other functions may be a concern as well. For example, external drive connections, such as Thumb Drives, often save drive identities and top level directory filenames in shellbags encoded into the registry. This content can persist long after the device is removed.
Once encrypted volumes are unlocked and mounted, all the standard Windows functions apply, including malware scanning, with copy/export if unknown executable, of the contents.
Simply plugging a thumb drive into a Windows machine will result in a hidden directory with a GUID (Globally Unique IDentifier) being written to the drive. To be fair, Mac's do this as well.
Along related privacy/security lines, encrypted PKzip files maintain a clear text list of all of the filenames in the archive. Note that 7zip does not do this.
In short, if you feel you need a higher level of privacy/security, you may want to re-evaluate your choice of operating systems or read Documentation >> System Encryption.
