What traces are left after booting by usb?

Question

1. Is it true that a bootable Ubuntu USB drive does not allow anything to be written to the computer's hard drive?
2. If so, would a computer with an SSD drive, like mine, also be left with no trace of a bootable USB session?

Answer 1

Many disks store a counter of power-on cycles, readable via SMART. (For example, in Windows one could use CrystalDiskInfo -- in all these screenshots you can read the "Power On Count" on the right hand side of the window https://www.google.com/search?q=crystaldiskinfo&source=lnms&tbm=isch)

This counter will be sensitive to booting off a different disk, but it won't be specific (the counter would also increase for entry to the BIOS setup screen, or a case where power was turned off again before loading the OS).

Because this counter is controlled by the drive's electronics, there is nothing that the Ubuntu software on the USB stick can do to prevent it from updating. It might be possible in some cases to clear or re-write the counter, but this would be specific to the disk model / firmware version and clearing the counter would still be detectable.

Some system BIOSes also keep a log of system events. I haven't seen one that records booting from removable media, but it is certainly feasible.

Of course you may also leave physical traces on the USB port itself, such as disturbing an oxidation layer.

Answer 2

Is it true that a bootable Ubuntu USB drive does not allow anything to be written to the computer's hard drive?

No. You can mount the disks and write all over them. After all, the USB stick is the main way Ubuntu users install Ubuntu for the first time.

But by default, Ubuntu won't mount anything you don't tell it to.

So if you didn't mount whatever partition "C:" is in reality, it would leave no trace of having been booted to Ubuntu.

Answer 3

Answer to 1.:

Ubuntu USB boot normally not even mounts the HDD/SSD of your system, and if mounted, it is read-only unless you tell Ubuntu to treat it as read and write.

Answer to 2.:

There will be no trace of an USB session unless you write to your HDD/SSD (see answer 1).

Answer 4

Be very careful of some answers on this page, It is very easy to write to and/or destroy the data on your internal drive(s) when running off of a Live or Persistent flashdrive..

I am using a pendrive install to write this, when I kook at Unity I see all of my internal partitions are mounted.

If I open gparted and want to modify, format or delete a partition, It generally first needs to be un-mounted.

While in gparted nothing needs to be un-mounted to create a new partition table and wipe the internal drive.

It can also be very dangerous to use dd from a flash drive, one very small error and everything on any drive can be wiped.

The answer to your second question is true, there may be no trace left of your bootable USB session or anything else.

No password is required for root permission on most Live and Persistent USB drives

Live and persistent installs are safe enough but learn the risks.

Answer 5

A live Ubuntu USB session leaves no traces whatsoever on the hard drive of the computer it is booted on unless Ubuntu is installed on the hard drive from the live USB session, and installing Ubuntu from an Ubuntu live USB or making changes to the computer's hard drive is not necessary, only optional.

Answer 6

I found the differences in answers on this page puzzling and decided to do a quick comparison between bootable USB install types using Ubuntu 16.04.1 64bit Desktop:

• Full Install using Ubiquity.

• Live syslinux Install using Startup Disk Creator.

• Persistent grub2 install using mkusb / dus

Live and Persistent installs had the same characteristics except as noted.

Full Install, (FS) vs Live/Persistent Install, (L/P)

USB OS automatically mounts all partitions* - Full - yes, L/P - yes

Internal partition writable without SU - Full - yes, L/P - no

Internal partition writable with SU - Full - yes, L/P - yes

Super User requires password - Full - yes, L/P - no

Gparted requires password - Full - yes, L/P - no

Install to internal drive requires password - Full - N/A, L/P - no

Uses internal drive's swap space, (if available) - Full - yes, L/P - yes

Uses internal drive's casper-rw partition, (if available) - Full - N/A, Live - no, Persistent - yes.

As long as the computer does not have a swap partition, a casper-rw partition, you are careful where you save things, you do not use gparted, boot-repair, click the install icon, type "sudo" or "dd" or try to back anything up, you should be OK. If it as a Live USB, (without persistence), and the internal drive is Windows just don't type "sudo" or use any utilities.

All results in this review can be easily duplicated.

• ISO9660 partitions are mounted but are read only images., as is the cdrom folder.