Do you mean: starting an installed version in live-mode (not tested, not supported yes) or starting a Whonix-Host iso file?

This ticket was written at a time when there was only grub-live. I.e. install Whonix on hardware (or Debian + grub live). Boot in live mode. Test if that works. If yes, take an hdd image. Boot again into live mode. Then take another hdd image. Compare these hdd images. Do they 100% match or are there differences? Differences: something wrong. No differences: that would be nice.

In case of Whonix Live ISO if that is booted I guess it won't modify the internal hdd (unless the user chooses to install). Pretty sure it is that way. But should be tested nonetheless.

Whonix Live ISO runs without an HDD.
I am not sure what you want to test here? Please precise.

In T910#19667, @onion_knight2 wrote:

Whonix Live ISO runs without an HDD.

Correct.

I am not sure what you want to test here? Please precise.

One would assume that Whonix Live ISO does not modify HDD. But are we sure? Should be tested.

Ok, so you want me to:

• boot a Whonix-Host ISO
• Install on HDD
• Reboot on Whonix-Host ISO, do some stuff, shutdown
• See if HDD has been modified (why would it be?)

Correct?

These tests are fully independent.

Test Nr 1)

• boot a Whonix-Host ISO (or any ISO)
• create a hashsum of the internal hdd
• reboot
• boot a Whonix-Host ISO
• reboot
• create a hashsum of the internal hdd
• compare hashsums

Very unlikely that hashsums changed.

Test Nr 2)

• boot a Whonix-Host ISO
• install Whonix-Host to internal hdd
• boot Wohnix-Host installed from internal hdd (in persistent mode)
• sudo apt install grub-live
• shutdown
• boot any Live ISO
• create a hashsum of the internal hdd
• shutdown
• boot Wohnix-Host installed from internal hdd in Live Mode
• do some stuff
• shutdown
• boot any Live ISO
• create a hashsum of the internal hdd
• compare hashsums

Unlikely that hashsum changed.

Have the dev team tested the anti-forensic capability of Whonix-live mode and grub live?