> Can the files be re-established
> (undeleted) from the hard drive / SSD?
TB is not anti-forensic:
https://www.researchgate.net/publication/332004753_Forensic_Analysis_of_Tor_Browser_A_Case_Study_for_Privacy_and_Anonymity_on_the_Web
https://research.torproject.org/techreports/tbb-forensic-analysis-2013-06-28.pdf
Thus either use tails or host live + whonix live mode if you dont want
traces to be left.
matthew...@danwin1210.me:
I notice that when I open a PDF in TBB I can choose to open it in the Tor
browser (which is what I do).
I also notice that, on my Ubuntu system, this creates a directory called
/tmp/mozilla_mycomputerusername0 which contains the downloaded PDFs.
So "open in browser" actually involves a download to the /tmp directory.
The permissions of the PDFs are -r--------
I close TBB and the PDFs vanish while the directory remains.
I am wondering how the PDFs are removed. One of the attractive aspects of
TBB (IIRC) was that all cookies, temp files, etc, are securely removed.
Can I ask how the PDFs are deleted. Can the files be re-established
(undeleted) from the hard drive / SSD?
--
tor-talk mailing list - tor-talk@lists.torproject.org
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
