Whonix LIVE - Testers Wanted!

Patrick · November 12, 2018, 6:57am

Whonix VirtualBox/KVM Live-mode!

Whonix now has the option of booting into a live system . When live-mode is chosen, all write operations will go to RAM instead of the hard disk. The primary objective of live-mode is to prevent malware from gaining a persistent foothold and to return the system to its state prior to booting.

$Ambox warning pn.svg.png\ 40x35$ Live mode is not amnesic; in particular, memory forensics has not been taken into account!

System with low resources:

If Whonix is running on a system will low RAM it is recommended that all non-essential processes are shutdown on the host. This will free up memory for virtual machine allocation, if needed.

Configuration instructions for live-mode:

https://whonix.org/wiki/Whonix_Live#Live-mode_Configuration

Note: Live-mode is currently unsupported with Qubes-Whonix. In Qubes R4, Qubes DisposableVMs are a suitable alternative, as well as the Qubes Live USB.

Follow Whonix live-mode Development:

Thanks to @Algernon and everyone else who made live-mode possible.

basaritamo · November 18, 2018, 9:06am

This is what i wanted! Now i use qubes, but with this, i going from qubes to normal linux + kvm + whonix live-mode when its final. But for now its buggy. Sometimes whonix start with the login screen. And sometimes whonix is really slow with one cpu.

glass · December 3, 2018, 2:37am

Recently tested the Whonix live mode. Set my KVM virtual disks to read-only as per the setup instructions. Even downloaded a couple files. Rebooted into normal Whonix mode and as expected, the downloaded files are gone. Also tested bookmarking a site. Again as expected once I rebooted into normal Whonix mode, the bookmark was no longer there. Video and audio worked fine in Live mode. Using it felt no different than if I was in standard Whonix mode. I had both the Gateway and Workstation in Whonix Live modes together. No issues.

glass · January 10, 2019, 1:21am

As a defense method, after using Whonix Live (for both Gateway and Workstation with Virtual Disks set to Read-Only) I am thinking the best thing to do would be to completely shut down the host computer to wipe the RAM?

Patrick · January 10, 2019, 5:34am

https://www.whonix.org/wiki/Dev/Technical_Introduction#Anti-forensic_Claims

Gary98 · April 29, 2019, 7:12am

Even downloaded a couple files. Rebooted into normal Whonix mode and as expected, the downloaded files are gone. Also tested bookmarking a site. Again as expected once I rebooted into normal Whonix mode, the bookmark was no longer there. Video and audio worked fine in Live mode.

Patrick · August 31, 2021, 5:06pm

Testing (to please myself) Live Mode User