if i use an external disk drive to update and save documents instead of the hard drive in the pc will it leave a trace of my documents on the disk drive in the computer? I know 'my recent documents' can be emptied etc, but I don't want to leave a trace of some confidential documents I need to work on while I'm away from my own computer
feedback
|
|
There's always a chance that parts of your document will be left in the page-file, and also that (depending on the application) temporary files in the | |||||||||||||||
feedback
|
|
1) traces of the USB drive itself are left in XP, including in the Device Manager (choose Show Hidden Devices from the menu, you will find an entry for "Generic Volume" or "USB Mass Storage Device" or such). This isn't traceable to a specific drive, as far as I know, and of course, this isn't necessarily what was asked, but it is good to remember that if you're not supposed to be plugging removable drives into a work computer, this will leave a trace... 2) Depending on what program you used to edit a file on a thumb drive, yes, windows will scatter references all over the computer. There will be a reference to the edited document in the MRU menu for the program used (such as Word), as well as an entry in Windows' "My Recent Documents" folder (as the original poster mentioned). Some programs even store a bitmap thumbnail of the file in the registry! (e.g. Paint.NET -- thanks, Paint.NET, for showing my girlfriend all my stump porn!) 3) Word uses hidden temporary files to store changes to a document. In the case of versions previous to Word '07, (or possibly '03, not sure) it used the filename format ~WRLnnnn.tmp. In later versions, it uses the pattern ~$_Important_Confidential_File.docx, where the original file is named My_Important_Confidential_File.docx. In either case, the temp file is generally stored in the same folder as the original -- sometimes, however, the file will be saved in the %TEMP% folder -- if, for instance, the drive is too full to allow the creation of a temporary file. Lastly -- Word sometimes creates an Autorecovery of the file in question, once again in the %TEMP% folder! 3) The name of the file may or may not show up in your Explorer history -- this can be removed, of course, by using INTERNET Explorer's Delete History function. 4) Last of all: good ol' hiberfil.sys and pagefile.sys. Hiberfil.sys is a copy of the computer's memory contents used to store the machine state for hibernation. Pagefile.sys is the swap file (used for virtual memory). It is theoretically possible to recover bits of a confidential file or file(s) from the page file or the hibernation file, even if the confidential file was loaded from a removable drive. However, unless the computer had a hard shutdown (i.e. loss of power) during the editing, it seems unlikely that even the best computer forensics expert would have an easy time recovering data in such a matter, or would have the motivation to try. Unless you're editing/viewing top secret government or corporate data, or confidential data that could endanger the lives or livelihoods of other people if the data were compromised or viewed by a third party, this is probably not something to worry about. | |||
|
feedback
|
more explanation on how to see this UUIDs and information here http://www.forensicswiki.org/wiki/USB_History_Viewing thats for the traces part,.. about the documents: cleaning the temp directories and recent documents is a good idee. you can use a portable version of CCleaner to do this. about the page file: a reboot should take care of this. but you are never safe from a ColdBoot Attack | ||||
|
feedback
|
