Can a virtual machine be used instead of the host?

Question

I was thinking of using a Debian guest as my main 'host' instead of my actual host (Ubuntu).

Do you think this will have any advantages in terms of making it difficult for digital forensics to recover the files that are in the guest OS?

The only encryption used in the Guest OS is encfs. Also the network is bridged. I don't plan on doing anything hardware intensive, just some Internet browsing and reading some PDFs.

If you think this is a bad idea or not worth it, could you recommend what I should do to keep someone in computer forensics from finding any deleted files or files for that matter? The host is also encrypted using encfs, and the virtualization software I use is Virutalbox.

Answer 1

Yes it is possible but unnecessary in your case.

People often use VMs to isolate potentially malicious applications from their main host and to have some sort of rewind button to restore the VM to a previous state in case something goes wrong in there, but looks like that's not what you want to do.

To defeat forensics all you need is full disk encryption with a strong key (long passphrase or key file), which will be impossible to defeat if done correctly; note that I said forensics and forensics only, if you're dealing with someone that can alter your machine while you leave it unattended (evil maid attack) you'll need to look into sealing your key into a TPM which will only unseal them if the machine hasn't been altered (on Linux there's TrustedGRUB which appears able to take advantage of a TPM but I didn't try it).

Your solution is a disaster both in terms of performance (you do encryption two times, both on the host and in the guest, 2x more overhead with only marginal security gain) and usability (as I said earlier, you can get the same security while getting native performance using full disk encryption).

As for deleting sensitive files on an unencrypted partition, you can use shred which overwrites the file multiple times, note that using it on an SSD is most likely counter-productive since the SSD's controller will write the new data on a different block of memory and not overwrite the same one, so in the end you'll only wear out your SSD faster; also note that while the file itself may be destroyed, your OS may keep fragments of the file or even the entire file somewhere else for other purposes, photo thumbnails for example; but none if this is necessary if you use full disk encryption assuming your key stays secret.

Answer 2

could you recommend what I should do to keep someone in computer forensics from finding any deleted files or files for that matter?

Securely delete files, and erase over the empty space on your hard disk with a three-pass algorithm. There's a great guide for that here, on AskUbuntu. Technically you can recover stuff that has been passed with less than 51 passes, but that's with highly specialized equipment and lots of motivation. Unless you're the world's largest exporter of drugs, hitmen, pirated movies, and child pornography all at the same time, this kind of attack would most likely not be leveraged against you. If you are, cut it out man! :P

Now to the meat of your question. I've found it's easier to do forensics on virtual machines because they're portable and snapshots remove a lot of the logistics. However, if you strongly encrypt the vdmk file with a different passphrase than the host, do not save snapshots, and keep Virtualbox from spewing things all over the filesystem, that would in theory be more secure than just a host OS.

Virtual machines also give you the distinct advantage of being able to shred (securely delete) your computer. Shredding the virtual machine directory would be quicker than using Darik's Boot and Nuke, and it wouldn't look very suspicious at first glance.

As with all questions like this, you have to keep in mind the probability of a situation like this happening. Don't live in a moated castle to keep out the unicorns.