General discussion

Locked

External HDD

By admin ·
I am using external usb hard drive to work on my excel files. I have heard that whatever files are left on the hard drive leave a evidance on the local hard drive where it was stored, that is why i use external hard drive. I would like to know does windows leave a trace of some fragments of the file on the operating system drive when i open files form the external hard drive? As to my knowledge the swap file might keep some trace. Is there a perfect solution around this?

This conversation is currently closed to new comments.

6 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by softcorp.us In reply to External HDD

Hello...

If you have sensitive data requiring high security, you will need to physically secure the computer. An external HDD is an improvement in some respects but not enough if you have sensitive data that must not escape.

Some data security considerations:
- Swap file contains all manner of data fragments.
- Many applications create work files that hold intermediate results.
- It is possible for an application ot allocate a memory block and not initialize it. The block will contain remnants of previous data that was stored there. If the block allocation was for an I/O buffer, the unused portion at the end of the block can still contain the original data. These blocks could easily end up being written to a HDD in a completely unrelated file.
- Deleted files can be easily recovered unless they are overwritten. This is widely discussed.
- Even deleted files that ARE overwritten can be recovered using special forensic techniques. To permanently erase a file so that it can never" be recovered, it must be overwritten many times with random data.
- Computers connected to a network can become infected with malware. Any data on them can be sent over the network without your knowledge.

Answer to be continued...

Collapse -

by softcorp.us In reply to

Q: I would like to know does windows leave a trace of some fragments of the file on the operating system drive when i open files form the external hard drive?
A: Yes. Some applications also use temporary files to store intermediate results. I don't think the current releases of Excel do this. This could change in future releases.

---

Q: As to my knowledge the swap file might keep some trace. Is there a perfect solution around this?
A: Not really. You could reboot your system with another operating system and overwrite the swap file. But, even THAT would not ensure all scraps of data from your Excel spreadsheet are overwritten.

---

Sorry there isn't an easy answer. You must physically secure your computer.

-----Steve Jackson

CEO/CSA
Software Corporation (Softcorp)
http://www.softcorp.us/probono
Advanced pro bono tools and utilities free for personal use

Collapse -

by admin In reply to External HDD

Point value changed by question poster.

Collapse -

by Kryptos In reply to External HDD

Yes windowds keep open tmp file when you open documents or files. which some times are not deleted on closing.

Even if its deleted, normally any delete won't really erase the data, OS just erases the pointers to the data location. data will be available till its over written by another set of data.

While writing files to harddisk OS dumps its memory content to fill up the rest of the sector after end of file mark. This could me data available in memory at that point of time.

swap files even though its deleted but it could be retrived as file deletes donot actually erase file contents.

And even if you erase or over write data there are technologies (costly ofcourse) to retrive those data.

Rgds,

Collapse -

by admin In reply to

Poster rated this answer.

Collapse -

by admin In reply to External HDD

This question was closed by the author

Back to Security Forum
6 total posts (Page 1 of 1)  

Related Discussions

Related Forums