OS X swap file may contain traces of the Tor Browser Bundle
|Reported by:||runa||Owned by:||tbb-team|
A forensic analysis of the Tor Browser Bundle (version 2.3.25-6, 64-bit) on OS X 10.8 showed that the OS X swap file may contain traces of the Tor Browser Bundle.
OS X relies on swap files and paging for memory and cache management. I have not been able to open the swap file, but I would say it is likely that /var/vm/swapfile0 contains traces of the Tor Browser Bundle and/or the attached external drive.