sensitive document revisited

[Mark]

Good morning.

Yesterday i was speaking with Charles and Suzanne, both
of whom were very helpful in helping me with my problem.

However, i still have one more question that i'm hoping
to clear up.

A document, saved to floppy (irregardless of all the
problems this causes with clutter) only, and never saved
to the hard drive. Does this document ever save itself
to the hard drive without my knowledge. I understand
that the document will auto save onto the floppy, but
suzanne mentioned something about a Windows temp folder
as well. And Charles mentioned something about "deleted
files". Where do these ghost files go? When are they
created?

My question is really only that, and the procedure i have
is very basic. I open a document from floppy, save to
floppy, close document, eject disc, and connect to
internet. Are there any files or remnants of files going
to my hard drive during this process? That's all i need
to know. And if so, where do they go?

For interests' sake, this document is not such that i
would need defence department standard security. It is
merely a bit of corporate information that i became
worried that i was being careless with. My interest has
now extended beyond just keeping the document secure, as
with yesterdays responses, i feel quite comfortable that
it wouldn't have been "stolen". I am now just curious
what Word does (Word XP incidentally), and am wondering
if, in theory, it would be possible for someone to hack
in and take it.

Again yesterdays answers were very helpful, and i think
this forum is great for these kinds of questions. I will
make much use of it in the future as well. If Charles or
Suzanne or anyone else would care to answer my question
here though, i'd be very thankful.

Yours truly,

Mark S.

 

[Graham Mayor]

As both Charles and Suzanne will have told you (it makes more sense to keep
your associated posts in the same thread) opening and saving documents
to/from floppy disc is one of the major causes of document corruption. I
will add my own warning. Do not do this or no-one will be able to access
your document - including you!

With the right tools and expertise a forensic investigator would be able to
recover data from your hard drive, but it is not something that can easily
be attempted. Word's encryption is very powerful and to all intents
unbreakable provided you use at least eight digits or random characters.
There are cracking programs out there that can break the password -
eventually - but this can take weeks of processing on a dedicated PC. You
will note that the demonstration versions (there is one linked from my web
site) restrict themselves to four characters.

Word's use of temporary files is explained at
http://support.microsoft.com/?kbid=89247

--
<>>< ><<> ><<> <>>< ><<> <>>< <>>< ><<>
Graham Mayor - Word MVP

Web site www.gmayor.com
Word MVP web site www.mvps.org/word
<>>< ><<> ><<> <>>< ><<> <>>< <>>< ><<>

 

[Mark]

Thanks for the reply. Again, i am well aware of the
problems of saving to floppy. That is not my concern at
present. My question was if, after doing the procedure i
described (ie. typing a document, saving it, closing it,
ejecting the disc) whether any file or remnants of a file
would be left on my machine.

Now, Graham, you're implying i think that the file does
somehow get saved to the HDD and that it would take
forensic investigators to uncover it? Is this true?
Does Word save the file to the HDD even if i am just
saving it to floppy, and does it remain there even after
i close the document.

I apologize if this question is confusing, but it's
really the only thing i'm wondering about, and i can't
seem to get a conclusive answer. Given the procedure i
use: (ie. typing a document, saving it, closing it,
ejecting the disc), is there at any time a point where
Word saves that document to hard drive without my
knowledge? If someone could answer this i'd be most
obliged. I really am not interested in anything
peripheral to this question, although i do appreciate the
response.

Also, i apologize for not keeping this in the original
thread, but i assumed that it would not be responded to
as it has fallen onto the fourth page or thereabouts. In
the future however, i will do this.

Thanks.

Mark.

 

[Graham Mayor]

The web portals are merely windows into usenet where most of those of us who
answer messages live. The messages will not be missed .

Word does not create copies of the document on the hard drive it creates
them in the folder with the document i.e. the floppy disc (which is why
there is a potential for corruption). There are working files created in the
Windows temp folder but they are not copies of the document - and if you
have autorecover information saving switched on there is another temp file
created on the hard drive.

Why not, with the document open, search the hard drive for filenames ~*.do?
and look in the user temp folder for the many *.tmp files Word creates
there. Examine them for yourself. Make copies of them and play around with
them. I have never known any of them amount to a copy of the document. I
believe there are circumstances when the temp files created in the *working
folder* i.e. on the floppy, can amount to a copy of the document, but I have
yet to see that for myself either.

--
<>>< ><<> ><<> <>>< ><<> <>>< <>>< ><<>
Graham Mayor - Word MVP

Web site www.gmayor.com
Word MVP web site www.mvps.org/word
<>>< ><<> ><<> <>>< ><<> <>>< <>>< ><<>

 

[Guest]

thanks graham. that's exactly what i wanted to know. I
will indeed play around with them and see if i can't find
out a little more. I have heard also that once those
documents are closed, the working files in the temp
folder disappear. Do you know if this is the case?

At any rate, thanks very much for the reply.

Mark.

 

[Graham Mayor]

Provided Word does not crash and that you have a recent operating system
such as Windows 2000/XP the temp files are removed, but as with anything
written to a hard drive, they could be forensically recovered. Whether that
would help anyone locate the content of your document is another issue
entirely.

--
<>>< ><<> ><<> <>>< ><<> <>>< <>>< ><<>
Graham Mayor - Word MVP

Web site www.gmayor.com
Word MVP web site www.mvps.org/word
<>>< ><<> ><<> <>>< ><<> <>>< <>>< ><<>

 

[mark]

thanks graham. And as a corrolary to that previous
question, i have one more. i swear only one more. You've
been extremely helpful.

If a hard drive is ghosted or pdqied or imaged in some way
i mean, does this image even those files which were only
detectable to forensics? What i'm wondering here is
whether someone could make a copy of my HDD over the
internet with Ghost or some other software and
then "forensically" examine my drive for those deleted
files from their own newly imaged hdd? Or does the image
software only make a superficial EXACT replica of the
drive.

Thanks.
Mark.

 

[Graham Mayor]

The short answer to this is that I don't know. My overriding feeling on this
is that only the readable files are transferred, but you would need a pair
of unused hard drives in order to establish this and I don't have them
available to test it. If this was to be the subject of a major legal issue,
I would want to seek the advice of someone dealing in forensic disc analysis
now and frankly I don't know where to direct you for that. Maybe a chat with
one of the disc manufacturers would be worthwhile?

The chances of someone making a Ghost-like image of your hard drive via the
internet, or of forensically examining your hard drive via the internet are
very slim - I would say impossible, but I don't know what tools the security
services have access to. If someone really wanted to examine your hard drive
in this sort of detail they would steal the computer - as this is *much*
easier to do.

--
<>>< ><<> ><<> <>>< ><<> <>>< <>>< ><<>
Graham Mayor - Word MVP

Web site www.gmayor.com
Word MVP web site www.mvps.org/word
<>>< ><<> ><<> <>>< ><<> <>>< <>>< ><<>

 

[Bob S]

A document, saved to floppy (irregardless of all the
problems this causes with clutter) only, and never saved
to the hard drive. Does this document ever save itself
to the hard drive without my knowledge. I understand
that the document will auto save onto the floppy, but
suzanne mentioned something about a Windows temp folder
as well. And Charles mentioned something about "deleted
files". Where do these ghost files go? When are they
created?

If you are using Word 2002 or later and you are working on a file from
a floppy, Word will create a copy of the document on your hard drive.

Word will also create an ASD file on your hard disk. This file
contains information from your document.

Word may or may not (depends on many factors) also create one or more
TMP files on your hard disk. These files contain information from your
document.

I do not know whether or not Word encrypts these files when it is
working on an encrypted document.

If anyone can access your hard disk while you are working on the
document, or if the files are left behind after the document closes
and someone can access your hard disk, that person can read the
contents of these files.

Even if the files are deleted when the document closes (which usually
happens automatically), then the disk blocks that these files used are
returned to the pool of unused disk blocks. Until these disk blocks
are used for some other purpose, the information that they contain
will remain on the hard drive. Anyone who has access to the hard drive
can find and read the information, but they need special software to
do it. This software is readily available on the Internet or in shrink
wrap packages and can be used by persons of minimal skill.

If you really care about keeping this information secret, you must at
the very least ensure that nobody has access to your hard drive while
the document is open, or after it is closed, until you have ensured
that all temporary files have been deleted and all free blocks have
been overwritten. "Access" would include sharing access, use of the PC
after hours, ability to remove and replace the drive, ability to clone
the drive, spyware or remote control programs, access to backup copies
of the drive, or any other form of access.

Bob S