Yes, it is "possible" for a computer forensics examiner to recover some of that information. The one thing to keep in mind about NTFS, is that there are lots of NTFS artifacts all over the computer that tracks everything you do. Sometimes, this information isn't recorded for the purpose of tracking, but it's just there. For example, I've found some screen shots of what was on the screen at one time thanks to memory being swapped to disk.
Another good example: Windows XP has built-in spyware by default: http://www.itlabsonline.com/windowsxpspywarelab.ht ml/
Another good example: Windows XP records all thumbdrives ever plugged into your computer:
http://www.itlabsonline.com/computerforensics-usb- lab1.html
The one thing that's always possible is whether or not screen information made it to swapspace on disk.
Slashdot Mirror
Yes, it is "possible" for a computer forensics examiner to recover some of that information. The one thing to keep in mind about NTFS, is that there are lots of NTFS artifacts all over the computer that tracks everything you do. Sometimes, this information isn't recorded for the purpose of tracking, but it's just there. For example, I've found some screen shots of what was on the screen at one time thanks to memory being swapped to disk. Another good example: Windows XP has built-in spyware by default: http://www.itlabsonline.com/windowsxpspywarelab.ht ml/
Another good example: Windows XP records all thumbdrives ever plugged into your computer:
http://www.itlabsonline.com/computerforensics-usb- lab1.html
The one thing that's always possible is whether or not screen information made it to swapspace on disk.