[tbb-bugs] #17367 [Tor Browser]: Swap files can contain evidence of browsing history

[Tor Bug Tracker & Wiki]

#17367: Swap files can contain evidence of browsing history
---------------------------------+---------------------------
     Reporter:  arthuredelstein  |      Owner:  tbb-team
         Type:  defect           |     Status:  new
     Priority:  Medium           |  Milestone:
    Component:  Tor Browser      |    Version:
     Severity:  Normal           |   Keywords:  tbb-disk-leak
Actual Points:                   |  Parent ID:  #17208
       Points:                   |    Sponsor:
---------------------------------+---------------------------
 Two forensic reports describe extracting Tor Browser browsing history from
 a Windows pagefile.sys and hiberfil.sys:

 See
 http://computerforensicsblog.champlain.edu/wp-content/uploads/2014/05
 /Uncovering-the-Covered-Tracks-Finding-What%E2%80%99s-Left-Behind-Saliba-
 Landry-5-19-2014.pdf#33
 and
 http://www.dfrws.org/2015eu/proceedings/DFRWS-EU-2015-short-
 presentation-1.pdf#16

 Is there any way we can programmatically clean up the pagefile on New
 Identity and/or browser exit? What about OS X and Linux?

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17367>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online