Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

if i use an external disk drive to update and save documents instead of the hard drive in the pc will it leave a trace of my documents on the disk drive in the computer? I know 'my recent documents' can be emptied etc, but I don't want to leave a trace of some confidential documents I need to work on while I'm away from my own computer

share|improve this question
    
You should define what you mean by "trace" –  Moab Apr 7 '11 at 1:01

3 Answers 3

There's always a chance that parts of your document will be left in the page-file, and also that (depending on the application) temporary files in the %temp% directory may be created during processing. Even if all the temporary files are deleted, without performing some fairly heavy-duty disk wiping, there's always a chance that the contents of the files will be recoverable.

share|improve this answer
    
+1 for disk wiping –  Jakob Cosoroaba Aug 16 '10 at 8:48
    
Almost -1 for a very, very generic answer (although correct) in a case where straight and well-known solution exists. –  whitequark Aug 16 '10 at 11:25
1  
@whitequark, fair enough, but if there's a straight and well-known solution, I suggest you post it as an answer to this question, rather than just leaving its absence as a criticism of my answer =) –  Rob Aug 17 '10 at 8:58
    
The Midday's answer explained that pretty good (for me). –  whitequark Aug 17 '10 at 9:27
1  
@whitequark, the OP doesn't actually ask about whether the USB device leaves traces of itself, rather specifically a trace of my documents on the disk drive in the computer. I answered the question they asked, not the one I thought they asked =) If I was being pedantic, I could point out that the OP only actually asked if traces of their documents would be left, but didn't specifically ask how to remove them, but that's far too pedantic, even for me ;=) –  Rob Aug 17 '10 at 18:52

1) traces of the USB drive itself are left in XP, including in the Device Manager (choose Show Hidden Devices from the menu, you will find an entry for "Generic Volume" or "USB Mass Storage Device" or such). This isn't traceable to a specific drive, as far as I know, and of course, this isn't necessarily what was asked, but it is good to remember that if you're not supposed to be plugging removable drives into a work computer, this will leave a trace...

2) Depending on what program you used to edit a file on a thumb drive, yes, windows will scatter references all over the computer. There will be a reference to the edited document in the MRU menu for the program used (such as Word), as well as an entry in Windows' "My Recent Documents" folder (as the original poster mentioned). Some programs even store a bitmap thumbnail of the file in the registry! (e.g. Paint.NET -- thanks, Paint.NET, for showing my girlfriend all my stump porn!)

3) Word uses hidden temporary files to store changes to a document. In the case of versions previous to Word '07, (or possibly '03, not sure) it used the filename format ~WRLnnnn.tmp. In later versions, it uses the pattern ~$_Important_Confidential_File.docx, where the original file is named My_Important_Confidential_File.docx. In either case, the temp file is generally stored in the same folder as the original -- sometimes, however, the file will be saved in the %TEMP% folder -- if, for instance, the drive is too full to allow the creation of a temporary file. Lastly -- Word sometimes creates an Autorecovery of the file in question, once again in the %TEMP% folder!

3) The name of the file may or may not show up in your Explorer history -- this can be removed, of course, by using INTERNET Explorer's Delete History function.

4) Last of all: good ol' hiberfil.sys and pagefile.sys. Hiberfil.sys is a copy of the computer's memory contents used to store the machine state for hibernation. Pagefile.sys is the swap file (used for virtual memory). It is theoretically possible to recover bits of a confidential file or file(s) from the page file or the hibernation file, even if the confidential file was loaded from a removable drive. However, unless the computer had a hard shutdown (i.e. loss of power) during the editing, it seems unlikely that even the best computer forensics expert would have an easy time recovering data in such a matter, or would have the motivation to try. Unless you're editing/viewing top secret government or corporate data, or confidential data that could endanger the lives or livelihoods of other people if the data were compromised or viewed by a third party, this is probably not something to worry about.

share|improve this answer

Microsoft Windows operating systems records artifacts when USB removable storage devices (thumb drives, iPods, digital cameras, external HDD, etc.) are connected to the system.

more explanation on how to see this UUIDs and information here http://www.forensicswiki.org/wiki/USB_History_Viewing

thats for the traces part,..

about the documents: cleaning the temp directories and recent documents is a good idee. you can use a portable version of CCleaner to do this.

about the page file: a reboot should take care of this. but you are never safe from a ColdBoot Attack

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.