Instead of using Live Mode I use KVM and Snapshots. After I am done using the VM I revert back to a older Snapshot of the VM. After reverting back to the older VM snapshot, are there any traces/forensics that are left behind from that session? I’ve browsed the wiki and online and couldn’t find anything.
1 Like