Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Suppose that I have a Veracrypt container on Windows 10. I unlock it, open and edit a Text document, open an image, watch a video. Then I close all files, unmount the container.
Then I run CCleaner to remove caches (including thumbnail) and wipe the free space on my hard (not SSD) drive. Then I run cipher wipe on the drive again just to be sure.
Is this enough to remove all traces of the contents of those files? I have hibernate disabled and the pagefile disabled btw.
I wouldn't count on it. Data has a habit of leaking all over the place; traces of your file content might still be in things like search indexes or application-specific caches.
It's certainly not sufficient to remove traces of the existence of those files. In addition to the aforementioned search indexes, you've got things like recently-used file lists, activity logs, and so on, giving the paths to no-longer-accessible files. The simple presence of something like "stolen_death_star_plans.pdf" in Acrobat Reader's "File" menu is suspicious.
If you want to be sure the contents of your encrypted disk remain hidden, boot your computer from a LiveCD or other read-only system before decrypting the container. Something like Tails (without a persistent volume set up) forgets about everything you did once you shut the computer down.
