Whonix VirtualBox/KVM Live-mode!

Whonix now has the option of booting into a live system . When live-mode is chosen, all write operations will go to RAM instead of the hard disk. The primary objective of live-mode is to prevent malware from gaining a persistent foothold and to return the system to its state prior to booting.

Live mode is not amnesic; in particular, memory forensics has not been taken into account!

System with low resources:

If Whonix is running on a system will low RAM it is recommended that all non-essential processes are shutdown on the host. This will free up memory for virtual machine allocation, if needed.

Configuration instructions for live-mode:

https://whonix.org/wiki/Whonix_Live#Live-mode_Configuration

Note: Live-mode is currently unsupported with Qubes-Whonix. In Qubes R4, Qubes DisposableVMs are a suitable alternative, as well as the Qubes Live USB.

Follow Whonix live-mode Development:

Whonix live mode Development Is there any interest in running whonix in live mode? I came across this (https://www.raspberrypi.org/forums/viewtopic.php?f=63&t=161416) a while ago and tested it on a debian vm. It only requires a small patch to the initramfs and minor changes in the grub config. With the setup you could run whonix always as a live system. Writes would go to RAM by default. But e.g. by choosing another boot option you could boot into an “update-mode” where you install updates, new software or make other per…

Thanks to @Algernon and everyone else who made live-mode possible.