I often test malware in QEMU VMs, and after I have tested some malware in a VM, I delete the VM for security reasons as well as the fact that if I want to test more malware, a clean environment to start with would be preferred.
However installing a new OS in a VM takes quite some time, especially Ubuntu and Fedora, so an easier option would just be to boot directly from the ISO and use a live session for one of those OSs.
But I would like to know, is running a live session from an ISO where data may be written back to it and kept there less secure than installing it properly to a Virtual Hard Disk? Is there actually any difference? Is the live session at all less secure than a proper one? Or are they the same and equally safe for malware testing?
My host is Arch Linux.