[tor-bugs] #8984 [Tor bundles/installation]: OSX FSEvents API files contain traces of the Tor Browser Bundle

[Tor Bug Tracker & Wiki]

#8984: OSX FSEvents API files contain traces of the Tor Browser Bundle
--------------------------------------+-------------------------------------
 Reporter:  runa                      |          Owner:  erinn
     Type:  defect                    |         Status:  new  
 Priority:  normal                    |      Milestone:       
Component:  Tor bundles/installation  |        Version:       
 Keywords:  tbb-disk-leak             |         Parent:       
   Points:                            |   Actualpoints:       
--------------------------------------+-------------------------------------
 A forensic analysis of the Tor Browser Bundle (version 2.3.25-6, 64-bit)
 on OS X 10.8 showed that FSEvents API files contain traces of the Tor
 Browser Bundle.

 The FSEvents API allows applications to register for notifications of
 changes to a given directory tree. Whenever the filesystem is changed, the
 kernel passes notifications to a process called fseventsd. The following
 file contains the path to the attached external drive, the path to the Tor
 Browser Bundle on the Desktop, and the path to the Tor Browser Bundle in
 the Trash:

  * /.fseventsd/0000000000172019

 Other files in the .fseventsd directory may also contain traces of the Tor
 Browser Bundle and/or the attached external drive.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/8984>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online