I recently made a Truecrypt AES encrypted folder and installed the Tor Browser Bundle into it.

I was wondering - if I delete the Truecrypt file, is there anything else left on my computer pointing to Tor or anything similar? I would assume there might be a few registry entries or something obscure that could be used against me.

The Tor FAQ doesn't really give a clear answer to this question, and I'm very curious if there are any further implications that I currently think.

1 Answer 1


This is a tough question for any operating system. And it's especially tough for operating systems, such as Windows and OS X, that are largely closed-source.

It's arguable that Windows' logging capabilities are largely undocumented, at least in public. My favorite example is "shellbags". It's my understanding that, prior to mid 2012, these registry entries were understood only by digital forensics experts.

Given that, how can one be certain that all traces of system usage have been removed? In my opinion, one can't. I'm not going to recommend any cleaners. But avoid those that don't address shellbags.

Whenever it seems important to remove traces of system usage, there are better alternatives. The best is using a LiveCD on a machine with no hard drive, and shutting down promptly after use (to avoid RAM dumping). For Tor, that means Tails.

Another possibility is using a machine with full-disk encryption. Traces remain, but adversaries can't see them unless they can decrypt the disk. However, in places where you could be forced to reveal the passphrase. avoid this approach ;)

It's also crucial to keep in mind that traces of Tor use may remain in logs retained by your LAN router and ISP. To avoid that, you could use a Tor bridge and/or VPN service. However, Tor bridges eventually become well-known, and VPN services (and/or their ISPs) may retain and share logs. I could say lots more about that, but I'll restrain myself ;)

  • This is an informative response. Great!
    – Roya
    Jun 11, 2014 at 14:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .