KVM - machines on external drive + amnesia

[STLD]

If the VM drives are moved to an external device (and only run from here), is any data written back from the guest to the host?
I know KVM/QEMU will leave log files on the host but actual data from the VMs? I will be using virt-manager on the host to work on the guests

[Patrick]

Nothing KVM specific. Related documentation:

Forensics

• Forensic Considerations
• Anti-forensic Claims

Live Operating System

• Is there Something like Whonix ™ Live?
• Is there a Whonix ™ Amnesic Feature / Live CD / Live DVD? What about Forensics?
• Will there be a Whonix ™ Live CD or DVD?

Encrypted Images