TrueCrypt: privacy of decrypted data

Question

TrueCrypt claims to store decrypted data only in RAM. But sometimes RAM gets dumped to swap (swap partition or swap file). Is this a privacy issue?

Answer 1

You might find some interesting reference for your point in this paper,
The persistence of memory: Forensic identification and extraction of cryptographic keys (PDF ref)

The authors of Volatility describe a hypothetical attack against TrueCrypt (Foundation, 2008), by studying its internal structures and behavior (Walters and Nick, 2007). They do, however, not describe how to locate the different structures in memory, and neither do they discuss the fact that some of these may be paged out, thereby breaking the chain of data structures that leads to the master key if only the memory dump is available for analysis.
...
In other fields of memory analysis, analysts have dumped the memory address space of a specific process by fetching pages from RAM and swap space. The dumps are sometimes sufficient to verify4 and even completely reconstruct executable files (Kornblum, 2006). According to several articles (for example, see Schuster, 2006 and Carvey, 2007), these techniques are able to identify trojans, rootkits and viruses that are stealthy and/or armored in Windows memory dumps.

more in the paper.

Answer 2

It might be an issue, but that would not be the only issue. Even without swapping, applications might write temporary files to disk, not being aware that the original file was stored in some secure way. Like a word processor might auto-save your document every now and then. And maybe a video player could auto-convert files that are not using its native format, and write that temporary file to disk as well.

Also, all programs will have (part of) the file in their own memory, which might be written to disk upon hibernation (sleep).