If I save file to my hdd (not ssd), move 2 trash, then cut /paste from trash to usb, will this hold up to forensic analysis designed to recover files?

Question

If I save a file (.odt,.txt, jpeg, etc) to my hdd (not ssd), move to trash, then cut /paste the files in the trash to a usb, would this hold up to the best forensic equipment trying to recover the files from my hdd afterwards?

Basically, I'm trying not to leave a trace of the file, obviously. Also, I'm thinking that if I don't want to "trash/delete" the files, since then they 'are' recoverable, what about just moving them to a usb (after I no longer need them) and scrubbing the usb with the dd command: sudo dd if=/dev/urandom of=/dev/sdx bs=8192.

So the question becomes, if I follow this method, are they still located on my hdd?

I would test it with PhotoRec, but since I am NOT deleting the file(s), it doesn't seem like using PhotoRec would be a viable option here.

Website article states the following:

"If you cut a file or a folder, it does not disappear, but instead becomes transparent. When you paste that file/folder, it is moved to the new location and disappears from the original location.

https://www.issco.unige.ch/en/research/tutoriel-informatique/EN/copy_cut_delete_move_and_paste.html

Answer 1

On a standard file system, erasing a file is just removing references to the data and making the space that holds the data available for reuse.

When you move a file to another location on the same file system, the data stays on the same place on the disk. For the purpose of hiding things, this is a no-op.

When you move a file to another file system, the system does a copy/erase. For the purpose of hiding things this is counter-productive. The initial data is still there on the original filesystem, it has just been marked erased. But now you have lost your reference to it, so you cannot overwrite it, unless you overwrite all the free space on the disk.

But all of this is idle talk if we don't know what the threat is:

• someone with admin rights
• someone with physical access to the computer...or your backups
• another "normal" user on the computer

You can't do much against 1) because this person can install keyloggers, or make copies of your files before you erase them.

For 2)

• Best defense is filesystem encryption (computer, and backups)
• Use the shred command, if the FS type and parameters are compatible with it
• Define a temporary file system (tmpfs) and destroy it when done.
• Save files directly to a removable device to which this person won't have access

For 3), file access rights should be enough if handled properly.

---

If you delete a file in an external drive:

• if you use rm in a shell, nothing is copied to your internal disk
• if you use a file manager:
  • there can be a "hard-delete" command (no trash) (Shift-Del in my file manager) that doesn't move the file to trash (direct equivalent to rm)
  • if you use the "soft-delete" that moves to trash, then it depends how the external drive is set up:
    • if the drive has its own trash folder, the file is moved to the trash file on the external drive and is not copied to your internal drive.
    • otherwise the file is copied to your general Trash folder on the internal drive, and erased on the external drive.