If I open a document from a USB flash drive but do not save it to the computer, can someone access the file’s contents after I remove the drive?

Question

I have a USB flash drive with confidential information on it and I will need to access this information on someone else's computer. The computer runs Windows 7 and has Microsoft Office 2007. If I open the document but do not save it to the computer's hard drive—just scroll through the information—will it be possible for a subsequent user to retrieve the document and open it after I remove the USB drive?

Since it is a public computer, I cannot install any programs that will wipe the hard drive. I don't care if a subsequent user sees that I have used a thumb drive, or that I opened a file. I just don't want anyone to be able to access the information in that file once I remove the thumb drive.

Solution

Yes! If this is a public computer or a machine that you do not control, you have to assume that there are terrible things on it that are out to steal your stuff and ruin your day.

Even if the OS hasn't been tampered with, the page/swap file very well could contain documents in part or in full, especially if the program you used to look at your files wasn't completely exited. Unless you specifically tell it to, Windows doesn't make any efforts to securely remove chunks of memory that are no longer in use from the page file. Further reading: this Security.SE question. Basically, somebody could just boot the computer from other media and trawl through \pagefile.sys.

There are all kinds of ways for people to spy on you if they have administrative access to the machine. Programs running as admin can debug any user's processes and read/write anywhere in memory. Anything that passes through RAM (i.e. anything you can see), no matter whether it ever goes on disk, could get caught by sophisticated software. If there are rootkits in play, it might not even be possible to see that shady things are running. An simpler approach, however, would just be to copy all files off of every removable device that gets inserted; this could be accomplished with just Task Scheduler and a bit of batch scripting.

If you can't trust a computer, you shouldn't handle sensitive data on it.

Comments

[fixer1234]

If it was viewed, might you not have cached contents? If it was edited, many programs save working drafts even if you don't save the file. These typically wouldn't be file copies sitting in an obvious place, but couldn't there be at least portions recoverable from the computer?

[Giacomo1968]

“If it was viewed, might you not have cached contents?” For web browser content, yes. But to my knowledge not something like a text file or a Microsoft Word document. Will update my answer to address the cached web content idea.

[Tetsujin]

wouldn't Word leave auto-saves on the HD? Even if it deleted them at close, an enterprising individual could trawl the drive.