[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-talk] How does TBB manage downloaded files (e.g. PDFs)?

> Can the files be re-established
> (undeleted) from the hard drive / SSD?

TB is not anti-forensic:

https://www.researchgate.net/publication/332004753_Forensic_Analysis_of_Tor_Browser_A_Case_Study_for_Privacy_and_Anonymity_on_the_Web

https://research.torproject.org/techreports/tbb-forensic-analysis-2013-06-28.pdf
Thus either use tails or host live + whonix live mode if you dont want traces to be left. 

matthewhtb@xxxxxxxxxxxxx:

I notice that when I open a PDF in TBB I can choose to open it in the Tor
browser (which is what I do).

I also notice that, on my Ubuntu system, this creates a directory called
/tmp/mozilla_mycomputerusername0 which contains the downloaded PDFs.

So "open in browser" actually involves a download to the /tmp directory.

The permissions of the PDFs are -r--------

I close TBB and the PDFs vanish while the directory remains.

I am wondering how the PDFs are removed. One of the attractive aspects of
TBB (IIRC) was that all cookies, temp files, etc, are securely removed.

Can I ask how the PDFs are deleted. Can the files be re-established
(undeleted) from the hard drive / SSD?




--
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk