Suppose a Veracrypt container was mounted and dismounted later. Then CCleaner was run, Youtube was used to watch videos, websites are browsed, and so on for 3 hours. Then computer went to sleep (hibernate and pagefile disabled). What are the chances that the container can be decrypted because of whatever is left (master keys?) in the RAM or some where else??

Veracrypt version is below 1.24.

  • What OS is this running on? On Linux, it'll be using the kernel's dm-crypt which does wipe keys.
    – forest
    Jun 23, 2021 at 1:09

1 Answer 1


I have not personally verified this but according to Veracrypt Sourceforge:

  1. When the volume is dismounted, we securely wipe the encrypted master keys from memory.

  2. When Windows is shutdown or rebooted, we securely wipe the large memory region that was allocated at startup.

My interpretation is that recovering the keys after dismount would be unlikely.

  • Think that is only for 1.24 version... and also RAM encryption must be selected as an option in Veracrypt. May 28, 2021 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.