Generally it only happens to programs you keep running in the background and might not use for a long time that also don’t have much background activity. For example password managers.
It depends on what you set your swappiness to, too. I think Linux distros still have pretty aggressive defaults that swap more than they probably need to.
I have taken a couple classes in Linux centric forensics and one of the things I often wandered about is if there is an easy way to add jitter or shift individual file blocks by a word (64 bits) or even half the size of a data block. Say every two hours shift up or down so attempts to read a mechanical hard drive would be chaotic.
Even without hibernation, data in apps you have open will end up in the swap if your system is ever RAM-constrained.
Generally it only happens to programs you keep running in the background and might not use for a long time that also don’t have much background activity. For example password managers.
It depends on what you set your swappiness to, too. I think Linux distros still have pretty aggressive defaults that swap more than they probably need to.
I have taken a couple classes in Linux centric forensics and one of the things I often wandered about is if there is an easy way to add jitter or shift individual file blocks by a word (64 bits) or even half the size of a data block. Say every two hours shift up or down so attempts to read a mechanical hard drive would be chaotic.