0

Suppose that I have a Veracrypt container on Windows 10. I unlock it, open and edit a Text document, open an image, watch a video. Then I close all files, unmount the container.

Then I run CCleaner to remove caches (including thumbnail) and wipe the free space on my hard (not SSD) drive. Then I run cipher wipe on the drive again just to be sure.

Is this enough to remove all traces of the contents of those files? I have hibernate disabled and the pagefile disabled btw.

1

I wouldn't count on it. Data has a habit of leaking all over the place; traces of your file content might still be in things like search indexes or application-specific caches.

It's certainly not sufficient to remove traces of the existence of those files. In addition to the aforementioned search indexes, you've got things like recently-used file lists, activity logs, and so on, giving the paths to no-longer-accessible files. The simple presence of something like "stolen_death_star_plans.pdf" in Acrobat Reader's "File" menu is suspicious.

If you want to be sure the contents of your encrypted disk remain hidden, boot your computer from a LiveCD or other read-only system before decrypting the container. Something like Tails (without a persistent volume set up) forgets about everything you did once you shut the computer down.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.