RE: File traces

["Tiago 'gouki' Faria" <gouki () goukihq org>]

I believe something will be placed on %tmp%. 

Windows Key + R and write %tmp%

Could be wrong though. 

-  
    .--.
   |o_o |       Tiago 'gouki' Faria [ gouki () goukihq org ]
   |:_/ |   
  //   \ \      Jabber: gouki () goukihq org
 (|     | )     WWW: http://goukihq.org
/'\_   _/`\
\___)=(___/


On Mon, 2008-10-06 at 11:33 -0400, John Grubb wrote:
> Just off the top of my head, I can think of these two things:
> 1)  Depending on which Office Programs you are talking about, there may be
> temporary files placed on the computer itself even though you are working
> off the USB drive.  These temp files may be recoverable.
> 2)  The history of a program will generally show the name and location of
> the last files opened by the program.  Even though you remove the USB drive,
> the name of the file will show unless you erase the program history.  While
> the file itself may be gone (because you removed the USB drive) the name may
> be enough to let people know something was there.
>
>
> John Grubb
> President
> Keystone Computer Concepts, Inc.
> 1-877-651-3939
> www.keystonecomputerconcepts.com      
>
>
>
>
>
>
> -----Original Message-----
> From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On
> Behalf Of Sumeet Narula
> Sent: Sunday, October 05, 2008 1:05 AM
> To: security-basics () securityfocus com
> Subject: File traces
>
> Hi,
>
> Can anyone tell me that if I store all my office files on the USB drive and
> programs on the Desktop, will there be any traces of the files on the
> desktop hdd even if I am opening files on the USB and saving them there
>
> Regards

Attachment: signature.asc
Description: This is a digitally signed message part