Removable media recovery from host

By 357 Stig
Apr 16, 2009
  1. hello all,

    just have a relatively simple question here. i am privy to somewhat sensitive info not meant for the general public and i store my files on a thumb drive for convenience so i can use any of the various agency machines. If i open a file from my thumb drive, can it somehow be recovered from the host computer I was using after i have disconnected from it? sorry i'm a n00b
  2. jobeard

    jobeard TS Ambassador Posts: 9,151   +598

    I guess you're thinking that data could have been cached on the host and might
    be accessible via the cache.

    It would be hard to locate and quickly lost due to normal operations.
    Some persistent data might be left if the system were to hibernate with the device
    attached. The hiberfil.sys file would be present for someone to scan through.

    If some data were encrypted, then the act of decrypting would leave tidbits in the temp\ directory.
    Use Disk Cleanup after you dismount the USB and before you logoff.
  3. 357 Stig

    357 Stig TS Rookie Topic Starter

    Ah thank you. Follow up Q, would the file names be accessible, i.e. if i can see them through the recent documents tab after i disconnect, are they on a list somewhere?
  4. captaincranky

    captaincranky TechSpot Addict Posts: 11,461   +1,760

    Just sort of butting in here with a wild guess, you might be able to find them in the system's temp directory before, but certainly not after, you ran disc cleanup as Jobeard has suggested.

    This is just some silly theoretical nonsense, nothing to concern yourself with. After data has been written to a HDD, it takes several passes with a "drive scrubbing" program" to absolutely render it unrecoverable. (writing 0s to the entire drive). In practice however, I would think that the (now vacant) temp file locations, would be overwritten by the system reusing them.

    Unless you specifically issue the command, "save or save as", the only place the files should exist are in "temp" or RAM.

    I think "recent documents" is a temp file, but Jobeard would know better than me.
  5. jobeard

    jobeard TS Ambassador Posts: 9,151   +598

    entirely correct -- and Recent Documents is just a link to the real copy elsewhere.

    I would not get paranoid on privacy -- be pragmatic. Unless you have a laptop that travels with you, simple delete file is sufficient. If you sell the system, remove the drive and keep it OR just reformat it.

    A laptop that travels has extra considerations for being stolen :(
    There, you need to encrypt all private files for the 1/20 chance that your system 'goes for a walk'.
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...