Or I open a video using vlc media player, and later delete it securely. Does vlc "retain" some of the parts of that video even after deletion?
6
-
1Do you mean you open the file in VLC, then delete the file from disk, but you still have the file open in VLC? Or do you mean you open the file in VLC, close VLC, and then delete the file?– hftFeb 18, 2022 at 4:37
-
I know I can't see the file in vlc after its deleted, but can someone with sufficient technical skills recover it from vlc?– voilaFeb 18, 2022 at 7:44
-
2There's not enough info to say. It depends on the program (does it read in the whole file, or only part? Does it write temp data anywhere? Does it cache data in memory? Does it release memory to the OS when done with it?), and also on what you did (did you close the file in the program? Did you close the program entirely? When you "securely deleted" the file, what process did you follow?), and even on the OS configuration (do you use a swap file / swap partition? What is the disk caching behavior? Has released memory been either wiped or overwritten?)– CBHackingFeb 18, 2022 at 8:47
-
1@CBHacking I think that could work as an answer– schroeder ♦Feb 18, 2022 at 8:53
-
In my opinion I would avoid writing a file at all. VLC accepts data from stdin or a named pipe (e.g. with a long random name of the pipe). So you could VLC like a streaming player and never write a file to the file-system. If no file is written (and VLC has no disk cache or something like that) it is more secure than if you write a file and then try to delete it's content. wiki.videolan.org/Uncommon_uses– RobertFeb 18, 2022 at 15:03
|
Show 1 more comment
2 Answers
If we open a file using a program, but then later securely delete that file, is it possible for that file to be recovered via that program?
Because "a program" could be any program, it is impossible to say for sure. We would have to know the details about what the program does. And it could do anything. For example, this hypothetical program could write a temporary copy of the file to disk in a different location, in which case, yes you could recover the file "via that program."
It is common for programs to use temporary file space. Operating systems often provide an API for just this purpose.
Because there are so many (infinite) possibilities, no one can provide a definitive answer. But, nevertheless, I will try to answer at least partially below.
Or I open a video using vlc media player, and later delete it securely. Does vlc "retain" some of the parts of that video even after deletion?
Again, we can't say for sure. But, we can talk about some ways the file might or might not be retained.
First, as pointed out in the comments, "securely" deleting a file is not always possible. And the feasibility depends not only on the operating system, and the application-level tool (e.g., sdelete), but also on the storage media controller (e.g., Flash controller might not wipe a physical block even when the OS thinks the data is gone).
Second, the inner workings of VLC are complex and it is difficult to know everything it does with the file data. Certainly, one would assume it reads the file data into a memory buffer (in RAM) and the data is retained for at least a while around when the video was played and VLC is running.
If VLC is not shutdown, it's not unreasonable to think that you could recover at least part of the video file data from RAM. But, less likely the whole video file would be stored in RAM unless it is a small video, just due to RAM being much more limited than disk storage.
Third, it's possible that VLC makes temporary files to cache some data. If it caches part of the video to disk than it could be possible to recover part of the video even after VLC is closed (provided it doesn't clean up the temporary space).
Finally, some video metadata might be logged or otherwise stored by VLC. If VLC stores this data to disk, and they contain video metadata, then at least that portion of information about the file might be recovered. Based on some of your comments it seems like VLC stores some metadata such as the filename or thumbnail images and then presents those to the user. This metadata is presumably stored to disk if it is persisted across restarting VLC. (Metadata like this could also be persisted by the operating system rather than the application, e.g., Window's recently used file lists.)
These points illustrate a few more reasons why it is difficult to give a definitive answer, but hopefully these points help you understand the situation and provide a partial solution to your problem.
As an addendum to hft's excellent answer, VLC has historically been shown to continue playing files that have been corrupted/written over, as seen in this Vault7 leak. The media player was just a vector to demonstrate the root cause: retention of the "deleted" file in the filesystem read cache (which has now been refactored - the behavior shown was on a Windows XP system).
