anti-forensics / amnesia testing of Whonix-Host in Live mode

[phabricator-migrator]

Information

ID: 910
PHID: PHID-TASK-t46eppmrszoi66n4xi35
Author: Patrick
Status at Migration Time: open
Priority at Migration Time: Normal

Description

Similar to:

Technical Introduction

Comments

---

onion_knight2

2020-03-22 17:07:26 UTC

Do you mean: starting an installed version in live-mode (not tested, not supported yes) or starting a Whonix-Host iso file?

---

Patrick

2020-03-22 17:19:22 UTC

This ticket was written at a time when there was only grub-live. I.e. install Whonix on hardware (or Debian + grub live). Boot in live mode. Test if that works. If yes, take an hdd image. Boot again into live mode. Then take another hdd image. Compare these hdd images. Do they 100% match or are there differences? Differences: something wrong. No differences: that would be nice.

In case of Whonix Live ISO if that is booted I guess it won’t modify the internal hdd (unless the user chooses to install). Pretty sure it is that way. But should be tested nonetheless.

---

onion_knight2

2020-03-22 18:53:28 UTC

Whonix Live ISO runs without an HDD.
I am not sure what you want to test here? Please precise.

---

Patrick

2020-03-22 19:23:27 UTC

! In T910#19667, @onion_knight2 wrote:
Whonix Live ISO runs without an HDD.

Correct.

I am not sure what you want to test here? Please precise.

One would assume that Whonix Live ISO does not modify HDD. But are we sure? Should be tested.

---

onion_knight2

2020-03-22 19:51:16 UTC

Ok, so you want me to:

• boot a Whonix-Host ISO
• Install on HDD
• Reboot on Whonix-Host ISO, do some stuff, shutdown
• See if HDD has been modified (why would it be?)
  Correct?

---

Patrick

2020-03-22 21:53:20 UTC

These tests are fully independent.

---

Test Nr 1)

• boot a Whonix-Host ISO (or any ISO)
• create a hashsum of the internal hdd
• reboot
• boot a Whonix-Host ISO
• reboot
• create a hashsum of the internal hdd
• compare hashsums

Very unlikely that hashsums changed.

---

Test Nr 2)

• boot a Whonix-Host ISO
• install Whonix-Host to internal hdd
• boot Wohnix-Host installed from internal hdd (in persistent mode)
• sudo apt install grub-live
• shutdown
• boot any Live ISO
• create a hashsum of the internal hdd
• shutdown
• boot Wohnix-Host installed from internal hdd in Live Mode
• do some stuff
• shutdown
• boot any Live ISO
• create a hashsum of the internal hdd
• compare hashsums

Unlikely that hashsum changed.

---

Patrick

2023-08-14 13:32:45 UTC

Have the dev team tested the anti-forensic capability of Whonix-live mode and grub live?