Whonix live mode / amnesia / amnesic / non-persistent / anti-forensics

[Patrick]

As noticed in above forum thread, /boot isn’t write protected. Any idea how /boot could also be covered?

Testing (to please myself) Live Mode User

mount time (time of last mounting of partition) is a pretty good guess. Maybe mount option in /etc/fstab noatime for /boot (and generally?) would help? Maybe there is a kernel boot parameter similar to noatime that we could set? Ideally in live mode mount times shouldn’t be recorded. It’s not a critical issue but for simplicity of dd whole encrypted disk and compare it would be much more handy if this issue wouldn’t exist. Non-Qubes-Whonix (and Kicksecure) VM images do not have a separate /b…