Are temp files created by Writes to USB device?

[zapp22]

Friends
recently a client of mine had a laptop stolen and a few issues and questions have resulted that pointed out some holes in my own understanding.
I need your expertise, please.

one of the points in question is, moving forward, how to write [vs copying if possible] important files directly to a USB removable device. Several questions arise:
- When a file is written / saved-to the usb device, are phantom copies made in the background, in a tmp directory on the main drive? If so, do they await 'deletion', and/or would a routine secure-wipe of free space deal with those?
- If a hacker/intruder/thief merely copies a file, is there a trace of that copy left somewhere in the pile? I understand that if a file is opened, barring extraordinary measures, windows keeps track of the last access. Further, if the drive is pulled, mounted on another system, and copies made, is there any trace of that activity left on the original source drive? I don't see how - but that's why I'm asking...

Thanks for all help

z

 

[Alejandro85]

Using normal copy operations, files are NOT bounced over a temporary storage when copying to pendrive, another disk or whathever. They're just read from the source and written into the destination, without touching anything on a third place. Actually, the file, in pieces I guess, is temporarily copied into RAM for processing during the copy operation, but since it's volatile you should not worry about that.

I don't get well the last question, but as far as I understand, if a drive is moved to another system, copies of everything can be made from there and, as you say, the "last access date" will be updated, but other than that, traces will not appear in strange places other than the real destination of files.

 

[zapp22]

thank you for an informed answer Alejandro. Yes you got the question right... from what I can tell, the thieves probably traded the unit immediately and the catcher probably pulled the drive if stealing the data was the intent so I'm looking for evidence of what, if anything, may have been copied.
In restoring/refurbing things for this lady, we want everything critical to be written directly to removable storage if possible. I'm posting separately about some questions related to the applications