Silk Road forums

Discussion => Security => Topic started by: gaia on February 27, 2012, 05:10 pm

Title: TOR web page history and images query
Post by: gaia on February 27, 2012, 05:10 pm
When using TOR via a USB stick, what happens to web page history and all those nice drug images that have loaded when you shut TOR down? I know the history is deleted, but is the cache stored on the stick or the PC? I also understand that anything deleted is not truly deleted. So I just wanted to know if they are hidden on the stick or the PC.

Thanks.
Title: Re: TOR web page history and images query
Post by: gaia on February 28, 2012, 12:02 pm
Bit of a blatant bump here guys, sorry.

Title: Re: TOR web page history and images query
Post by: Horizons on February 28, 2012, 12:12 pm
The cache is gone too. The version of Firefox bundled with the TBB is configured to clear all browsing data on shutdown. If for some reason it doesn't get deleted, it'll be on the USB stick.
Title: Re: TOR web page history and images query
Post by: gaia on February 28, 2012, 12:59 pm
It's what 'deleted' actually means is what I'm getting at as well. But thanks for confirming that everything left behind is on the stick. I just wanted to be sure that nothing leaked over to the main operating system drive.

I know the browsing history is deleted from Firefox on exiting TOR, but I presume the file system just makes available the space used for temporarily storing web pages etc, and doesn't actually delete them?

I know there is the option to use a bootable USB as John Keats thread makes clear, but there are all sorts of compatibility issues there, so it's not a smooth ride. So it's just a damn shame there isn't some utility out there that simply deep cleans you history completely without having to do a full format as the only alternative.

As a small time buyer, I'm being super paranoid here I know. But I'd like to be as safe as possible, but at the same time taking the easiest possible route. It's not just the police I'm scared of here, in fact I doubt they would have much interest in me. No, it's my very inquisitive and IT literate family that scare the shit out of me! If they find out about my drug interests, they would inflict more damage on me than any police force could :)
Title: Re: TOR web page history and images query
Post by: Horizons on February 28, 2012, 01:27 pm
Alright, in that case here's a more in-depth answer for you: when you use the tor browser bundle, incriminating data will exist in two places:

cookies and the cache stored in the portable firefox folder of your thumbdrive, and
the RAM on your computer.

Unless there's some program running on the computer specifically for that purpose (like a keylogger or one of many trojans that monitor user activity), nothing you do in a portable application should affect files on the host computer's hard disk. That' the point of an application being portable in the first place.

Data on RAM will disappear when you shut down the computer, and even before that it will be overwritten quickly after you're done with what you're doing, unless you have a lot more RAM than you actually use. So that's safe unless someone dumps the RAM to disk right after you get off.

The files on your USB drive will get deleted when you close the TBB. That just means that they address where the files are stored on disk will be marked as available on the MFT. The data itself is still there until it gets overwritten. You can wipe the free space on the drive every time after using Tor if you're especially paranoid, but that will greatly reduce the lifespan of your USB drive. Otherwise, the data can be very easily recovered by someone with access to your USB drive and one of several free file recovery programs that are readily available online.

The solution? Encrypt the filesystem on your USB drive.

I hope that was more helpful. Cheers,
Horizons.
Title: Re: TOR web page history and images query
Post by: gaia on February 28, 2012, 03:07 pm
Crystal clear now Horizons, thanks a lot for taking the time mate. TrueCrypt it is then and encrypt the whole USB I presume.

Thanks again.