I have secret details on a VHD, bitlocker protected.

When I open this, the details are on Notepad.

But when I finish and eject the open VHD, all the secret details
remain on notepad.

Is there any way to display the secret details and then make them
disappear when the VHD is ejected?

Or can I just turn off the new persistent Notepad.

Edition Windows 11 Pro
Version 23H2
Installed on ?04-?Nov-?22
OS build 22631.3085
Experience Windows Feature Experience Pack 1000.22684.1000.0
2024-01 Cumulative Update Preview for Windows 11 Version 23H2 for
x64-based Systems (KB5034204)

On 1/30/2024 8:38 PM, Peter Jason wrote:
> I have secret details on a VHD, bitlocker protected.
>
> When I open this, the details are on Notepad.
>
> But when I finish and eject the open VHD, all the secret details
> remain on notepad.
>
> Is there any way to display the secret details and then make them
> disappear when the VHD is ejected?
>
> Or can I just turn off the new persistent Notepad.
>
> Edition Windows 11 Pro
> Version 23H2
> Installed on ?04-?Nov-?22
> OS build 22631.3085
> Experience Windows Feature Experience Pack 1000.22684.1000.0
> 2024-01 Cumulative Update Preview for Windows 11 Version 23H2 for
> x64-based Systems (KB5034204)
>

I turned mine off.

The problem was, if you had opened a 400MB text file, then
closed the Notepad window, the next time you started Notepad,
you had to wait until the 400MB file was opened again. While
mine wasn't a security issue, it was a performance issue. So I
turned off the persistence.

https://www.elevenforum.com/t/how-does-notepad-open-content-from-the-previous-session-store-data.18978/

"The information is stored locally in

C:\Users\<YourUsername>\AppData\Local\Packages\Microsoft.Windows.Notepad_8wekyb3d8bbwe\LocalState\TabState
C:\Users\Gebruiker\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\WindowState
"

Which means your private data is somewhere in AppData now.

Some other people have your problem.

https://www.elevenforum.com/t/windows-11-notepad-now-automatically-saving-plaintext-versions-of-encrypted-text-files.18560/#post-358330

Paul

On Tue, 30 Jan 2024 22:25:45 -0500, Paul <nospam@needed.invalid>
wrote:

>On 1/30/2024 8:38 PM, Peter Jason wrote:
>> I have secret details on a VHD, bitlocker protected.
>>
>> When I open this, the details are on Notepad.
>>
>> But when I finish and eject the open VHD, all the secret details
>> remain on notepad.
>>
>> Is there any way to display the secret details and then make them
>> disappear when the VHD is ejected?
>>
>> Or can I just turn off the new persistent Notepad.
>>
>> Edition Windows 11 Pro
>> Version 23H2
>> Installed on ?04-?Nov-?22
>> OS build 22631.3085
>> Experience Windows Feature Experience Pack 1000.22684.1000.0
>> 2024-01 Cumulative Update Preview for Windows 11 Version 23H2 for
>> x64-based Systems (KB5034204)
>>
>
>I turned mine off.
>
>The problem was, if you had opened a 400MB text file, then
>closed the Notepad window, the next time you started Notepad,
>you had to wait until the 400MB file was opened again. While
>mine wasn't a security issue, it was a performance issue. So I
>turned off the persistence.
>
>https://www.elevenforum.com/t/how-does-notepad-open-content-from-the-previous-session-store-data.18978/
>
> "The information is stored locally in
>
> C:\Users\<YourUsername>\AppData\Local\Packages\Microsoft.Windows.Notepad_8wekyb3d8bbwe\LocalState\TabState
> C:\Users\Gebruiker\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\WindowState
> "
>
>Which means your private data is somewhere in AppData now.
>
>Some other people have your problem.
>
>https://www.elevenforum.com/t/windows-11-notepad-now-automatically-saving-plaintext-versions-of-encrypted-text-files.18560/#post-358330
>
> Paul

Thank you. I will turn off saving the notepads automatically.

Paul wrote on 1/30/24 8:25 PM:
> On 1/30/2024 8:38 PM, Peter Jason wrote:
>> I have secret details on a VHD, bitlocker protected.
>>
>> When I open this, the details are on Notepad.
>>
>> But when I finish and eject the open VHD, all the secret details
>> remain on notepad.
>>
>> Is there any way to display the secret details and then make them
>> disappear when the VHD is ejected?
>>
>> Or can I just turn off the new persistent Notepad.
>>
>> Edition Windows 11 Pro
>> Version 23H2
>> Installed on ?04-?Nov-?22
>> OS build 22631.3085
>> Experience Windows Feature Experience Pack 1000.22684.1000.0
>> 2024-01 Cumulative Update Preview for Windows 11 Version 23H2 for
>> x64-based Systems (KB5034204)
>>
>
> I turned mine off.
>
> The problem was, if you had opened a 400MB text file, then
> closed the Notepad window, the next time you started Notepad,
> you had to wait until the 400MB file was opened again. While
> mine wasn't a security issue, it was a performance issue. So I
> turned off the persistence.
>
> https://www.elevenforum.com/t/how-does-notepad-open-content-from-the-previous-session-store-data.18978/
>
> "The information is stored locally in
>
> C:\Users\<YourUsername>\AppData\Local\Packages\Microsoft.Windows.Notepad_8wekyb3d8bbwe\LocalState\TabState
> C:\Users\Gebruiker\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\WindowState
> "
>
> Which means your private data is somewhere in AppData now.
>
> Some other people have your problem.
>
> https://www.elevenforum.com/t/windows-11-notepad-now-automatically-saving-plaintext-versions-of-encrypted-text-files.18560/#post-358330
>
> Paul
>
Are you saying when all files are closed before closing Notepad or just
closing Notepad via the 'X', that Notepad's setting 'When Notepad starts'
*Open in a new window' opens the previous opened file(s).

Note:
The other optional alternate feature 'When Notepad starts' setting is
*Open content from the previous session*

N

--
....w¡ñ§±¤ñ

On 1/31/2024 4:58 PM, ...w¡ñ§±¤ñ wrote:

> Are you saying when all files are closed before closing Notepad or
> just closing Notepad via the 'X', that Notepad's setting
> 'When Notepad starts' *Open in a new window' opens the previous opened file(s).
>
> Note:
> The other optional alternate feature 'When Notepad starts' setting
> is *Open content from the previous session*
>
> N

If you carefully close all the tabs, then exit Notepad, nothing
would be presented on the next start of Notepad.

If you left any tabs loaded, then clicked the "X", those tabs were remembered.

You can stop the behavior, and terminate all Notepad activity
each time you click the "X", by using the setting you name.

[Picture]

https://i.postimg.cc/RVFvNhZP/notepad-not-open-previous-session-content.gif

"Open content from the previous session" is no longer ticked.

I found where the temporary file is stored.

C:\Users\username\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\TabState
206,373,977 0997efdf-a014-4cd9-8b8b-ba266738ad3b.bin

the file header is lightly obfuscated, by adding 128 bytes to the
beginning of it. The letters "NP" being fitted as a Magic value
which causes other utilities to think it is a "data: " file. The
content is not encrypted in any way. If the file has 0x0D 0x0A sequences,
these are compressed by removing the 0x0A from the sequence. The file
"re-inflates" if you save the tab off to a new file location.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000 4E 50 00 01 26 43 00 3A 00 5C 00 55 00 73 00 65 NP..&C.:.\.U.s.e
00000010 00 72 00 73 00 5C .r.s.\

So this does represent bad security and shutting it off via Settings
wheel in Notepad is required.

Paul

On Wed, 31 Jan 2024 19:41:16 -0500, Paul <nospam@needed.invalid>
wrote:

>On 1/31/2024 4:58 PM, ...w¡ñ§±¤ñ wrote:
>
>> Are you saying when all files are closed before closing Notepad or
>> just closing Notepad via the 'X', that Notepad's setting
>> 'When Notepad starts' *Open in a new window' opens the previous opened file(s).
>>
>> Note:
>> The other optional alternate feature 'When Notepad starts' setting
>> is *Open content from the previous session*
>>
>> N
>
>If you carefully close all the tabs, then exit Notepad, nothing
>would be presented on the next start of Notepad.
>
>If you left any tabs loaded, then clicked the "X", those tabs were remembered.
>
>You can stop the behavior, and terminate all Notepad activity
>each time you click the "X", by using the setting you name.
>
> [Picture]
>
> https://i.postimg.cc/RVFvNhZP/notepad-not-open-previous-session-content.gif
>
>"Open content from the previous session" is no longer ticked.
>
>I found where the temporary file is stored.
>
>C:\Users\username\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\TabState
> 206,373,977 0997efdf-a014-4cd9-8b8b-ba266738ad3b.bin
>
>the file header is lightly obfuscated, by adding 128 bytes to the
>beginning of it. The letters "NP" being fitted as a Magic value
>which causes other utilities to think it is a "data: " file. The
>content is not encrypted in any way. If the file has 0x0D 0x0A sequences,
>these are compressed by removing the 0x0A from the sequence. The file
>"re-inflates" if you save the tab off to a new file location.
>
>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
>
>00000000 4E 50 00 01 26 43 00 3A 00 5C 00 55 00 73 00 65 NP..&C.:.\.U.s.e
>00000010 00 72 00 73 00 5C .r.s.\
>
>So this does represent bad security and shutting it off via Settings
>wheel in Notepad is required.
>
> Paul
>

Thanks again. I have turned off the "remember last".
But how can I remove the past history of all this?
Can I just delete the....
C:\Users\username\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\TabState
206,373,977 0997efdf-a014-4cd9-8b8b-ba266738ad3b.bin
Folder, and all others in it?
>

On 1/31/2024 9:29 PM, Peter Jason wrote:
> On Wed, 31 Jan 2024 19:41:16 -0500, Paul <nospam@needed.invalid>
> wrote:
>
>> On 1/31/2024 4:58 PM, ...w¡ñ§±¤ñ wrote:
>>
>>> Are you saying when all files are closed before closing Notepad or
>>> just closing Notepad via the 'X', that Notepad's setting
>>> 'When Notepad starts' *Open in a new window' opens the previous opened file(s).
>>>
>>> Note:
>>> The other optional alternate feature 'When Notepad starts' setting
>>> is *Open content from the previous session*
>>>
>>> N
>>
>> If you carefully close all the tabs, then exit Notepad, nothing
>> would be presented on the next start of Notepad.
>>
>> If you left any tabs loaded, then clicked the "X", those tabs were remembered.
>>
>> You can stop the behavior, and terminate all Notepad activity
>> each time you click the "X", by using the setting you name.
>>
>> [Picture]
>>
>> https://i.postimg.cc/RVFvNhZP/notepad-not-open-previous-session-content.gif
>>
>> "Open content from the previous session" is no longer ticked.
>>
>> I found where the temporary file is stored.
>>
>> C:\Users\username\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\TabState
>> 206,373,977 0997efdf-a014-4cd9-8b8b-ba266738ad3b.bin
>>
>> the file header is lightly obfuscated, by adding 128 bytes to the
>> beginning of it. The letters "NP" being fitted as a Magic value
>> which causes other utilities to think it is a "data: " file. The
>> content is not encrypted in any way. If the file has 0x0D 0x0A sequences,
>> these are compressed by removing the 0x0A from the sequence. The file
>> "re-inflates" if you save the tab off to a new file location.
>>
>> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
>>
>> 00000000 4E 50 00 01 26 43 00 3A 00 5C 00 55 00 73 00 65 NP..&C.:.\.U.s.e
>> 00000010 00 72 00 73 00 5C .r.s.\
>>
>> So this does represent bad security and shutting it off via Settings
>> wheel in Notepad is required.
>>
>> Paul
>>
>
> Thanks again. I have turned off the "remember last".
> But how can I remove the past history of all this?
> Can I just delete the....
> C:\Users\username\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\TabState
> 206,373,977 0997efdf-a014-4cd9-8b8b-ba266738ad3b.bin
> Folder, and all others in it?
>>

That size is just the size of the file I used as a marker.
I made a big file, so it would stand out like a sore thumb.

It was the path of the file, that was a giveaway as to what
it was. The file size was not an exact match, but it was
sitting in my search window, right next to the original
source file.

When you untick "Open content from the previous session",
the TabState directory is cleared.

However, you know how disk erasure works.

When you delete a file, a single byte in the $MFT is flipped.
The details (file name) still sits in the MFT slot.

The clusters the file lived in, are still there.

Really, nothing was removed.

Using Recuva, you could scan the disk, and if not many
changes to the disk have happened, Recuva will give
a file name and a "green dot". The green dot means the
clusters have *not* been overwritten, and the file is
perfectly recoverable.

On a hard drive, I would tell you to use

sdelete.exe -z C:

and that would zero out all the white space on the disk,
including the clusters mentioned above (freshly liberated
clusters).

https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete

I use sdelete.exe all the time, for cleaning of virtual machines
before putting them away. (Zeros take no storage space in dynamic
containers.)

A TRIM in the Optimize window, may play a part in overwriting the
clusters, but all of these processes take time to have results.
Whereas sdelete, is if you need it done right away. I don't know
enough about TRIM, to be offering security advice regarding its
usage. Sdelete is a waste of SSD write life, so that's the price
you pay for a clearance operation.

You were on a mounted VHD, so the Optimize menu will tell you
it's not going to do a damn thing and that "the slabs are optimal",
whatever that means. It's some wishy-washy stuff that means it's
not going to do anything.

Microsoft has never shown any "Heidi Eraser" tendencies in the
past, and to miss this security issue, I doubt they have a custom
cleaner to cover the security exposure. If they'd used crypto on
the TabState folder, we wouldn't be having this discussion
(the disk would have the crypto on it, only RAM would have plaintext).

Paul