Removable media recovery from host

Status
Not open for further replies.
hello all,

just have a relatively simple question here. i am privy to somewhat sensitive info not meant for the general public and i store my files on a thumb drive for convenience so i can use any of the various agency machines. If i open a file from my thumb drive, can it somehow be recovered from the host computer I was using after i have disconnected from it? sorry i'm a n00b
 
I guess you're thinking that data could have been cached on the host and might
be accessible via the cache.

It would be hard to locate and quickly lost due to normal operations.
Some persistent data might be left if the system were to hibernate with the device
attached. The hiberfil.sys file would be present for someone to scan through.

If some data were encrypted, then the act of decrypting would leave tidbits in the temp\ directory.
Use Disk Cleanup after you dismount the USB and before you logoff.
 
Ah thank you. Follow up Q, would the file names be accessible, i.e. if i can see them through the recent documents tab after i disconnect, are they on a list somewhere?
 
Just sort of butting in here with a wild guess, you might be able to find them in the system's temp directory before, but certainly not after, you ran disc cleanup as Jobeard has suggested.

This is just some silly theoretical nonsense, nothing to concern yourself with. After data has been written to a HDD, it takes several passes with a "drive scrubbing" program" to absolutely render it unrecoverable. (writing 0s to the entire drive). In practice however, I would think that the (now vacant) temp file locations, would be overwritten by the system reusing them.

Unless you specifically issue the command, "save or save as", the only place the files should exist are in "temp" or RAM.

I think "recent documents" is a temp file, but Jobeard would know better than me.
 
entirely correct -- and Recent Documents is just a link to the real copy elsewhere.

I would not get paranoid on privacy -- be pragmatic. Unless you have a laptop that travels with you, simple delete file is sufficient. If you sell the system, remove the drive and keep it OR just reformat it.

A laptop that travels has extra considerations for being stolen :(
There, you need to encrypt all private files for the 1/20 chance that your system 'goes for a walk'.
 
Status
Not open for further replies.
Back