Page MenuHomePhabricator

anti-forensics / amnesia testing of Whonix-Host in Live mode
Open, NormalPublic

Description

Similar to:
https://www.whonix.org/wiki/FAQ#Anti-forensic_Claims

In essence:

  • make an image
  • boot into live mode
  • do things
  • make another image
  • compare those images
    • if they match: great, we're amnesic
    • if not: problem

Details

Impact
Normal

Event Timeline

Patrick triaged this task as Normal priority.Apr 23 2019, 1:29 PM
Patrick created this task.

Do you mean: starting an installed version in live-mode (not tested, not supported yes) or starting a Whonix-Host iso file?

This ticket was written at a time when there was only grub-live. I.e. install Whonix on hardware (or Debian + grub live). Boot in live mode. Test if that works. If yes, take an hdd image. Boot again into live mode. Then take another hdd image. Compare these hdd images. Do they 100% match or are there differences? Differences: something wrong. No differences: that would be nice.

In case of Whonix Live ISO if that is booted I guess it won't modify the internal hdd (unless the user chooses to install). Pretty sure it is that way. But should be tested nonetheless.

Whonix Live ISO runs without an HDD.
I am not sure what you want to test here? Please precise.

Whonix Live ISO runs without an HDD.

Correct.

I am not sure what you want to test here? Please precise.

One would assume that Whonix Live ISO does not modify HDD. But are we sure? Should be tested.

Ok, so you want me to:

  • boot a Whonix-Host ISO
  • Install on HDD
  • Reboot on Whonix-Host ISO, do some stuff, shutdown
  • See if HDD has been modified (why would it be?)

Correct?

These tests are fully independent.


Test Nr 1)

  • boot a Whonix-Host ISO (or any ISO)
  • create a hashsum of the internal hdd
  • reboot
  • boot a Whonix-Host ISO
  • reboot
  • create a hashsum of the internal hdd
  • compare hashsums

Very unlikely that hashsums changed.


Test Nr 2)

  • boot a Whonix-Host ISO
  • install Whonix-Host to internal hdd
  • boot Wohnix-Host installed from internal hdd (in persistent mode)
  • sudo apt install grub-live
  • shutdown
  • boot any Live ISO
  • create a hashsum of the internal hdd
  • shutdown
  • boot Wohnix-Host installed from internal hdd in Live Mode
  • do some stuff
  • shutdown
  • boot any Live ISO
  • create a hashsum of the internal hdd
  • compare hashsums

Unlikely that hashsum changed.

Patrick renamed this task from amnesia testing of Whonix-Host in Live mode to anti-forensics / amnesia testing of Whonix-Host in Live mode.Apr 28 2020, 5:03 PM