0

If I save a file (.odt,.txt, jpeg, etc) to my hdd (not ssd), move to trash, then cut /paste the files in the trash to a usb, would this hold up to the best forensic equipment trying to recover the files from my hdd afterwards?

Basically, I'm trying not to leave a trace of the file, obviously. Also, I'm thinking that if I don't want to "trash/delete" the files, since then they 'are' recoverable, what about just moving them to a usb (after I no longer need them) and scrubbing the usb with the dd command: sudo dd if=/dev/urandom of=/dev/sdx bs=8192.

So the question becomes, if I follow this method, are they still located on my hdd?

I would test it with PhotoRec, but since I am NOT deleting the file(s), it doesn't seem like using PhotoRec would be a viable option here.

Website article states the following:

"If you cut a file or a folder, it does not disappear, but instead becomes transparent. When you paste that file/folder, it is moved to the new location and disappears from the original location.

https://www.issco.unige.ch/en/research/tutoriel-informatique/EN/copy_cut_delete_move_and_paste.html
10
  • Cut/paste is just move, which across drives is just copy-then-delete. So your assumption that you aren't deleting the files is not valid. Does this change your expected outcome? – Fox Sep 22 '19 at 0:11
  • "moving them to a usb … and scrubbing the usb with the dd command" ?!? I must be missing something here, because that makes no sense whatsoever. If it's what it sounds like, it's the equivalent of making a photocopy of a document and then running the photocopy through a shredder. What's the point? – Ray Butterworth Sep 22 '19 at 0:21
  • If you want to make a file irrecoverable by forensics, no need for such a raindance, use the shred command. Note that this doesn't delete the file name from various places in the filesystem. – xenoid Sep 22 '19 at 0:32
  • @Fox So, cutting and pasting is equivalent to deleting. I was hoping this was not the case. – topencrypt Sep 22 '19 at 0:42
  • @xenoid Yes, I thought the names would still be there somewhere. QUESTION: What happens if I save it to the desktop, then move it to trash so I know I am done with it, but then move it to a junk folder in documents (cut/paste), for instance. If I shred it from the documents directory, is there a copy of it saved on the desktop? – topencrypt Sep 22 '19 at 0:47
4

On a standard file system, erasing a file is just removing references to the data and making the space that holds the data available for reuse.

When you move a file to another location on the same file system, the data stays on the same place on the disk. For the purpose of hiding things, this is a no-op.

When you move a file to another file system, the system does a copy/erase. For the purpose of hiding things this is counter-productive. The initial data is still there on the original filesystem, it has just been marked erased. But now you have lost your reference to it, so you cannot overwrite it, unless you overwrite all the free space on the disk.

But all of this is idle talk if we don't know what the threat is:

  • someone with admin rights
  • someone with physical access to the computer...or your backups
  • another "normal" user on the computer

You can't do much against 1) because this person can install keyloggers, or make copies of your files before you erase them.

For 2)

  • Best defense is filesystem encryption (computer, and backups)
  • Use the shred command, if the FS type and parameters are compatible with it
  • Define a temporary file system (tmpfs) and destroy it when done.
  • Save files directly to a removable device to which this person won't have access

For 3), file access rights should be enough if handled properly.


If you delete a file in an external drive:

  • if you use rm in a shell, nothing is copied to your internal disk
  • if you use a file manager:
    • there can be a "hard-delete" command (no trash) (Shift-Del in my file manager) that doesn't move the file to trash (direct equivalent to rm)
    • if you use the "soft-delete" that moves to trash, then it depends how the external drive is set up:
      • if the drive has its own trash folder, the file is moved to the trash file on the external drive and is not copied to your internal drive.
      • otherwise the file is copied to your general Trash folder on the internal drive, and erased on the external drive.
11
  • at xenoid. Thx. Seems worst thing anyone can do is 'trash, delete, cut' since, as you mentioned, can not go back & 'destroy', & files have not moved a bit. Not saving it to the comp in 1st place is best, but if necessary, a temp folder, then destroy. I'm assuming when I am deleting files that are saved on a usb or sd, and not saved to the computer, that the computer's hdd is not seeing these files ever. Also, I can make this another question, but it seems like a dumb one... w/ encrypted hdd, once I log in & decrypt, doesn't that decrypt the hdd - now, all files avail to everyone on computer? – topencrypt Sep 23 '19 at 10:05
  • Not temp folder, temp file system... Yes, encryption is mostly a protection against theft and people who have physical access. If other people are using the computer at the same time, they see a decrypted file system. If you share the computer with others (sequential use) you can have an additional encrypted partition and mount it when you login. – xenoid Sep 23 '19 at 11:32
  • at xenoid: If I am deleting files from a usb or external hdd, do the 'deleted' files "ever" end up in the internal hdd's 'trash'? It seems impossible if the files aren't really moving, but rather the pointers are moving (or something like that)...? Yes, temp file system just uses RAM, saves nothing. Thanks. – topencrypt Sep 23 '19 at 12:11
  • @topencrypt See edited answer – xenoid Sep 23 '19 at 14:39
  • at xenoid: wow!! i didn't know that (internal hdd trash vs ext hdd trash)- which is extremely important to know! One of the problems with "saving files to an external hdd" is that certain files (currently) automatically appear without my permission, like "Thumbnails" hidden directory. That is actually how this topic started for me, but it was not the only thing, by far. Thanks again. – topencrypt Sep 26 '19 at 0:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.