What actually lands on the disk

You open a browser, look at some pages, close it. The question is what is left on the storage afterwards, and the answer has two halves that people keep merging into one.

Start with the honest good news, because it is often undersold. Tor Browser is deliberately built not to accumulate. It does not keep browsing history across sessions, it clears cookies and site data when it closes, it maintains no long lived cache, and it syncs no profile to an account. Set against a mainstream browser signed into a personal account, the difference in what persists is large and it is not cosmetic.

Now the other half. That browser is one process on top of an operating system with its own housekeeping, its own performance tricks and its own diagnostics, none of which were consulted about its goals. The system does not know that a particular window is meant to be forgettable. It applies the same general behaviour it applies to everything.

What the disk actually records

Five ordinary mechanisms account for most of it, and all five exist for reasons that have nothing to do with surveillance.

System caches and temporary files

Operating systems keep scratch space. Fonts, icons and decoded images get cached, and applications are given a temporary directory to work in. A program is supposed to clean up after itself when it exits, and well behaved ones try. A program that crashes cleans up nothing. What is left is usually fragmentary, and fragmentary is not the same as absent.

Swap and paging

When memory gets tight, a system moves pages of memory onto storage so it can carry on. That is the entire point of swap. The consequence is that data which only ever lived in memory can end up written to a disk, without any program asking and without any user action. On a machine encrypted at rest, the swap area is normally inside that encryption. On a machine without it, swap is another region of storage.

Crash reports and diagnostics

When something falls over, systems and applications commonly capture a report so the failure can be diagnosed. That report can include the state of the program at the moment it died, which is a snapshot of memory rather than a tidy log line. Some stay local. Some are queued for sending to whoever wrote the software, which turns a local artefact into a network event. See the rest of the software.

Recent items and search indexes

Desktop systems keep lists so menus can offer the thing you just had open, and build search indexes so finding a file is instant. Those lists and indexes are storage in their own right. They record names, paths and times, and they outlive the file. A deleted file can still be named in a recent list, because the list is a separate structure that was never told.

Thumbnails and previews

Any system that shows you a grid of images is generating small copies and keeping them somewhere so the grid is fast the next time. A thumbnail is a real image file. It is derived from an original, it is smaller and lower quality, and it is stored independently of the original. That is why images deserve their own card at screenshots and photos.

What the disk does not record

Two overestimates are worth correcting, because they lead people to worry about the wrong thing.

The first is the idea that everything you looked at is sitting somewhere as a readable page. It is not. There is no complete transcript of a browsing session written to storage by a browser that is designed not to write one. What survives is incidental and partial: a fragment in a temp directory, a page of memory in swap, a name in a list. That is meaningfully different from a browsing history file, and anyone who tells you otherwise is describing an ordinary browser rather than this one.

The second overestimate is about the network side. Nothing on your disk tells your ISP anything. Your line saw encrypted traffic and timing, as covered in the shape of the traffic. Your disk saw content and kept scraps of it. Combining the two requires somebody with access to both.

And an underestimate, for balance: the absence of browser history is not the absence of evidence of the browser. The application itself is a file on the disk with an installation date and a last used time, as every application is. Whether the browser is present is a far easier question than what it was used for.

Written by the browser

Very little, by design, and cleared between sessions

Written by the system

Caches, swap, crash data, recent lists, thumbnails

Lifetime

Until overwritten, which is not a schedule anyone controls

Readable by

Anyone with the machine and the time to look

What changes the answer

4 things change how much this action gives away. None of them takes it to zero, and none of them is a promise.

1. Know that the layers are separateThe single most useful correction is understanding that a careful browser and a careless operating system can coexist on the same machine. Once that is clear, the rest of this section stops being surprising. It does not make either layer behave differently.
2. Full disk encryption changes the at rest questionA machine encrypted at rest and genuinely powered off is a different object from one that is unlocked and running, because the scraps described above are inside the encrypted volume. It does nothing at all while the machine is unlocked and in use, which is most of the time.
3. Fewer sessions on a shared machineIncidental retention happens on whichever machine did the work. A machine that several people use is a machine where those scraps are in a shared object, which is the subject of lending the machine. This changes where the scraps are, not whether they exist.
4. Do not confuse deletion with removalSending a file to a bin removes a name from a listing. Whether the underlying data is still recoverable depends on the storage technology and on what has happened since, and it is not something a file manager reports on. Assume the honest answer is uncertain.

What this card is not

This card describes what a general purpose computer retains and why. It is not a cleanup procedure, and it makes no claim that any particular machine is or is not clean.

Questions that come up

Is Tor Browser leaving a history file?

It is designed not to. It does not carry history, cookies or site data from one session to the next. The retention described on this page comes from the operating system layer, not from the browser.

Does using a private window change any of this?

A private window is a browser level setting about a browser level store. It has no bearing on swap, crash reports, thumbnails or system search indexes, because those are produced by a different layer entirely.