So my friend has TOR and he uses it to get some game stuff. But when we went through his files, pictures and videos, we found some files that he claims he never downloaded and they must have piggy backed off his TOR downloads. Now I dont know if he was embarassed by them and used TOR as a scapegoat, or he was serious. I am not a tech kind of guy, and the same goes for my other friends. I'm worried if I use this the same thing might happen to me. I dont want random questionable files showing up in my computer.

  • regarding this aspect, Tor is not really different than any other protocol/connection/network/service (like clearweb-pages, email, etc.): it is as easy or hard to accidentally download a file - or files within an archive - you don't want, as it is from any other "normal" site/email/etc. - in this case you can look at Tor as just a different type of connection. Mar 21, 2019 at 14:22

2 Answers 2


Tor is a proxy overlay network and is not capable itself of downloading any files on behalf of the user besides the network files associated with the service itself running along with the distributed hash table information that is synced periodically for consensus on the network to allow the onion routing to actually take place.

That being said, other proxy networks like i2p and zeronet are configured so that the user automatically becomes a server and uses a percentage of the users local disk to store content shared to the network of users. Tor is not like these services and does not have that capability in its feature set.

So, your inclination may be correct, they were using Tor as a scapegoat. Another option is that there was a compressed file (like .zip or tar.gz) that, upon download, was expanded to reveal more files than what was supposed to be inside the compressed file.

"Never attribute to malice that which is adequately explained by stupidity, but don't rule out malice either." - Hanlon's Razor


It is technically possible to download other stuffs but not by TOR itself. I mean TOR is using three router to connect the client to the destination server and if the connection is not secure, the third router (exit node) technically can intercept your connection and inject data to the download stream. But this is very risky method and I do not think any exit node does such thing.

Another possibility is the download site itself. If the download site is some kind of torrent site or warez site, it is possible to add extra downloads to the main download, no matter what browser is used. Hope it helped.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .