Remove all traces of files used in Veracrypt container... is this enough?


  • QA Engineer

    Suppose that I have a Veracrypt container on Windows 10. I unlock it, open and edit a Text document, open an image, watch a video. Then I close all files, unmount the container.

    Then I run CCleaner to remove caches (including thumbnail) and wipe the free space on my hard (not SSD) drive. Then I run cipher wipe on the drive again just to be sure.

    Is this enough to remove all traces of the contents of those files? I have hibernate disabled and the pagefile disabled btw.



  • I wouldn't count on it. Data has a habit of leaking all over the place; traces of your file content might still be in things like search indexes or application-specific caches.

    It's certainly not sufficient to remove traces of the existence of those files. In addition to the aforementioned search indexes, you've got things like recently-used file lists, activity logs, and so on, giving the paths to no-longer-accessible files. The simple presence of something like "stolen_death_star_plans.pdf" in Acrobat Reader's "File" menu is suspicious.

    If you want to be sure the contents of your encrypted disk remain hidden, boot your computer from a LiveCD or other read-only system before decrypting the container. Something like Tails (without a persistent volume set up) forgets about everything you did once you shut the computer down.



Suggested Topics

  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2