The fact that you would not be anonymous would not be a fool!

[Демитрий]

The fact that you would not be anonymous would not be a fool!

Let's imagine that your PC is absolutely clean, all your files that can lead to a sad outcome are encrypted and hidden in cryptocontainer . And your PC is completely clean, you have deleted all correspondence, you have deleted all the files, the password for the cryptocontainer is in your head, and no one can get it.

But you neglected permanent deletion, since deleted files can be recovered. But in addition to irrevocable deletion, do not forget about the data in RAM.

What happens when a PC gets to an expert for analysis?
All that an expert has is a hard drive, this is the ultimate basis for analysis. But there are also digital clues that are stored in RAM. Turning off the PC, without making a snapshot of the RAM, the expert can lose the latest messages, encryption keys, correspondence, and so on, many data will be irretrievably lost. In this case, the expert will have to work with RAM.

What can be found in RAM?
If you approach the issue comprehensively, then in RAM you can find the following things:

• Recent posts in social networks
• Notes of Ghost
• Messages through chats built into the game.
• Downloaded files, images from resources, EVEN if the privilege mode is enabled, the cache and history are disabled.
• Registry branches
• Downloaded programs and unpacked programs
• Data on network connections.
• And the most dangerous is the encryption keys. Which will decrypt your cryptocontainers and gain access to them. Alternatively, Elcomsoft Forensic Disk Decryptor is used.

How is the dump removed?

The dump is removed using a regular USB flash drive, which allows you to contain the contents. There are many analysis tools, both paid and free. It is logical that for paid programs a license costs a lot of money and well-known structures use them. But you can use the regular and free versions, as an option Belkasoft. This software only takes a snapshot of the RAM, for further analysis. The analysis is already taking place in approximately the same scenario, there are also different analysis programs, but you can use the free version from Belkasoft. Most information is destroyed after turning off the PC, but not all!

Most evidence is obtained in this way. Many do not suspect and do not know that in RAM, some information can be stored. Up to correspondence.

There is only one cure, it is necessary to completely dump the RAM dump by using additional software. Simply shutting down the PC will not save you from this. A more comprehensive approach is needed.

As a result, even using permanent deletion and having an absolutely clean PC, your logs are still stored!

 

[root]

All this is so - only the wrong term is used here - " data in RAM "
Let's see how scary it is and whether there is a chance to get around this "curse"
The fact is that the real "Computer RAM" is completely destroyed when it is turned off, since the RAM modules are a set of capacitors that store the values 0 and 1. When the power is turned off, the capacitors are discharged and all one of them disappears, and the information disappears with them .
It concerns memory type DDR (1,2,3,4) SDRAM, etc. AND does not concern Flash memory.
But the computer has a dynamic memory extension (the so-called SWAP (or Russian swap)), it is a file on the hard drive (by default for Windows, drive C: /) and it is called pagefile.sys (by default, it has an amount equal to the amount of RAM + 10% of it) If there is not enough space in the RAM, some of the programs lying in it are transferred to the hard drive, to this file, from where they get as needed. Because programs can only be run in the computer's RAM.
This file will be studied by the forensic scientist described above.
You can disable this file if you have a lot of RAM (32 GB or more), but remember, you should not run many programs at the same time (for example, 10 open pages in a browser at the same time - in fact these are 10 open browsers, each of which has one page open .

You should not disable a swap, but you can delete it every time you turn it off or reboot.

Clearing a swap file on shutdown (Windows)

To enable cleaning of the pagefile.sys file when the operating system shuts down, you must run the secpol.msc command ("Start - Run") in command line mode. In the window that opens, you should find the element "shutdown: cleaning the swap file ...". By double-clicking on it, we set the security parameter to “Enabled” and click the “Apply” button. These actions are shown in the following two figures.

Now when you turn off or restart the swap file will be cleared
The disadvantage is that the time to restart or turn off the computer increases
Time is highly dependent on the speed of the hard drive.
for example, on a fast SSD with a swap of 40 gigabytes, turning off the computer becomes longer by about 2 minutes,
2 minutes the swap is overwritten.

But since this file was stored on a hard disk, the contents of the file when turned off, in principle, can be read.
But this is a completely different story.