Warn about Whonix Live on VM Guest leaving traces?

On Live Mode for Whonix there is no mention of possibly of leaving traces on Host OS when swapping (or paging) when you are using Whonix Live in a VM.

On Tails docs page they mention it:

Traces of your Tails session are likely to be left on the local hard disk. For example, host operating systems usually use swapping (or paging) which copies part of the RAM to the hard disk.

Only run Tails in a virtual machine if leaving traces on the hard disk is not a concern for you.

This is why Tails warns you when it is running inside a virtual machine.

Also some useful info they add such as:

The Tails virtual machine does not modify the behaviour of the host operating system and the network traffic of the host is not anonymized. The MAC address of the computer is not modified by the MAC address anonymization feature of Tails when run in a virtual machine.

Live Mode for Whonix links to Live Mode for Kicksecure.

On the bottom of the Whonix wiki page, there is Template:Upstream wiki - Whonix which might not have been clear enough.

That wiki template has been revised just now. It now contains a notice:

Incomplete: This wiki page is incomplete. It only contains specific information for Whonix. Below is a link to a wiki page in the Kicksecure wiki with more general information. Reading it is mandatory for full information.

So that means that the Whonix wiki for this page is incomplete? But do you consider Kicksecure’s wiki even complete that it doesn’t contain this important info?

It’s what the wiki page is literally saying.

Kicksecure wiki does mention this.

1 Like

Yeah, you are right Live Mode for Kicksecure

By itself, starting a VM in live mode is not amnesic. Many users are unaware that activities performed inside the VM might be stored on the host mass storage device (hard drive, HDD, SSD) in locations that are hard to review (for the majority). Extra steps must be performed on the host operating system to minimize these traces – see Anti-Forensics Precautions, or better, use Live Mode as HOST.