Was the Tor Browser Bundle built with aim not to leak information to the file system (e.g. to temporary files), to the disk in general (e.g. to the swap) and by other means to other applications (e.g. over D-bus)?
Tor Browser Bundle tries to leaves no trace on the filesystem, but there are several limitations.
- As documented in the most recent analysis (as of Sept, 2013), there are several places TBB leaves a trace on the filesystem, usually due to Operating System mechanics and not due to TBB's fault itself.
- TBB can't avoid writing memory to disk in a swap space scenario unless the operating system has disabled swap.
- You have to extract TBB to the filesystem. If you don't do a secure deletion (overwriting the data as opposed to just selecting it and hitting 'delete'), the data will be in 'free space' and may be recovered by forensic disk analysis tools