This commit is contained in:
nihilist 2024-11-03 18:22:39 +01:00
parent db4fd98c94
commit 48013fc5f6

View file

@ -145,7 +145,7 @@ The door is closed, the conversation remains between Alice and Bob, their conver
<img src="7.png" class="imgRz"> <img src="7.png" class="imgRz">
<p>To make it short, if you start your operating system in live mode, <b>you are not writing anything on the system disk</b>, but rather <b>you are loading the entire operating system in the RAM</b>. Everthing that you write on the system drive while in live mode gets erased upon rebooting. </p> <p>To make it short, if you start your operating system in live mode, <b>you are not writing anything on the system disk</b>, but rather <b>you are loading the entire operating system in the RAM</b>. Everthing that you write on the system drive while in live mode gets erased upon rebooting. </p>
<p>The idea behind using live mode is that <b>every forensic trace regarding the hidden encrypted volume</b> that would normally be written into the system logs, kernel logs, and various other system files <b>(that we would normally need to manually clean up after closing the hidden volume)</b> will all be written into RAM instead of being written onto Disk, and then <b>will all be completely erased upon rebooting the computer.</b> </p> <p>The idea behind using live mode is that <b>every forensic trace regarding the hidden encrypted volume</b> that would normally be written into the system logs, kernel logs, and various other system files <b>(that we would normally need to manually clean up after closing the hidden volume)</b> will all be written into RAM instead of being written onto Disk, and then <b>will all be completely erased upon rebooting the computer.</b> </p>
<p>As you'll see in <a href="../livemode/index.html">this tutorial</a> </p> <p>As you'll see in <a href="../tailsqemuvm/index.html">this tutorial</a>, we can make use of a VM's live mode to securely erase every trace of sensitive activity.</p>
</div> </div>
</div><!-- /row --> </div><!-- /row -->