If I am working writing a text document in a text editor (say notepad or MS word, or ...) then I can save the file and the encrypt this file. I can then try to erase the original file by overwriting it (using proper software). From what I understand there is a small (?) problem doing this because copies of the file might be made elsewhere on the hard drive. (I understand that parts of the file might also exist in the memory, but for this question I would be interested in what happens on the hard drive)

I was wondering if this problem can be avoided by using a portable version of the text editor running of a USB key and saving the file to the USB key only. That way one can physically carry the USB key around which offers some security.

My question is if this is correct. When using a portable program on a USB key, is it common that the programs saves (backup)copies of the file on the hard drive?

More generally: Is there a value in using portable programs on a USB key?

  • You can always store a bootable OS on the key... properly configured it could leave almost no trace.
    – KnightOfNi
    Apr 21, 2014 at 23:18
  • TAILS is an exception to all the rules you will see here. It is completely separate and leaves no traces on the hard drive.
    – SDsolar
    Apr 21, 2017 at 7:05

1 Answer 1


So answering backwards:

Yes There is advantage to using portable programs on a USB key.

  • Access to programs not available on existing OS configuration.
  • Versions not available.
  • Not leaving wholesale footprints on the OS.


  • There is some evidence left behind on the OS.

    1. Programs used will leave evidence on 'last run programs list'
    2. Memory used (programs / documents) may leave evidence in the virtual memory system, even saving the data to the hard drive in the swap files.
    3. Logging in the OS will record the programs/documents depending on how setup.
    4. Aggressive reporting programs (or spyware) may log / record / investigate the running system.
    5. The software program itself may store details on the C:/ drive, temp directory or registry.
  • There is some evidence left on the network.

    1. Logging on the Proxy servers.
    2. Browser detection on the Proxy Servers.
    3. Other Logging and Application detection due to network access.
    4. Program / intrusion detection in the Network (Intrusion Detection Systems - IDS / Intrusion Protection System - IPS).
  • It makes sense that there would various logs. I hadn't thought about that. But will there be any content from the file on the hard drive? So, if I for example edit a file located on a USB key with, for example portable notepad also located on the USB key, is it likely that any parts of the file makes it onto the hard drive?
    – Thomas
    Apr 22, 2014 at 0:58
  • @Thomas - yes, it is likely and in general, you have no control over it. Apr 22, 2014 at 5:12
  • Yes @Thomas, you need to expect the evidence to be there, but the effort for someone to retrieve the program and data in the virtual memory system might preclude someone searching for it in practice. Apr 28, 2014 at 4:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .