[tor-talk] How does TBB manage downloaded files (e.g. PDFs)?

[bo0od]

 > Can the files be re-established
 > (undeleted) from the hard drive / SSD?

TB is not anti-forensic:

https://www.researchgate.net/publication/332004753_Forensic_Analysis_of_Tor_Browser_A_Case_Study_for_Privacy_and_Anonymity_on_the_Web

https://research.torproject.org/techreports/tbb-forensic-analysis-2013-06-28.pdf

Thus either use tails or host live + whonix live mode if you dont want 
traces to be left.

matthewhtb at danwin1210.me:
> I notice that when I open a PDF in TBB I can choose to open it in the Tor
> browser (which is what I do).
> 
> I also notice that, on my Ubuntu system, this creates a directory called
> /tmp/mozilla_mycomputerusername0 which contains the downloaded PDFs.
> 
> So "open in browser" actually involves a download to the /tmp directory.
> 
> The permissions of the PDFs are -r--------
> 
> I close TBB and the PDFs vanish while the directory remains.
> 
> I am wondering how the PDFs are removed. One of the attractive aspects of
> TBB (IIRC) was that all cookies, temp files, etc, are securely removed.
> 
> Can I ask how the PDFs are deleted. Can the files be re-established
> (undeleted) from the hard drive / SSD?
> 
> 
>