Generally it only happens to programs you keep running in the background and might not use for a long time that also don’t have much background activity. For example password managers.
It depends on what you set your swappiness to, too. I think Linux distros still have pretty aggressive defaults that swap more than they probably need to.
I have taken a couple classes in Linux centric forensics and one of the things I often wandered about is if there is an easy way to add jitter or shift individual file blocks by a word (64 bits) or even half the size of a data block. Say every two hours shift up or down so attempts to read a mechanical hard drive would be chaotic.
This. Swap files on LUKS encrypted partition. Also, the swapspace daemon!
I’ve seen so many setups where people encrypt their data but forget to encrypt their swap.
what’s the problem? it’s not like you dump the entire contents of your system’s ram to disk any time use hibernate /s
Even without hibernation, data in apps you have open will end up in the swap if your system is ever RAM-constrained.
Generally it only happens to programs you keep running in the background and might not use for a long time that also don’t have much background activity. For example password managers.
It depends on what you set your swappiness to, too. I think Linux distros still have pretty aggressive defaults that swap more than they probably need to.
I have taken a couple classes in Linux centric forensics and one of the things I often wandered about is if there is an easy way to add jitter or shift individual file blocks by a word (64 bits) or even half the size of a data block. Say every two hours shift up or down so attempts to read a mechanical hard drive would be chaotic.