1

The context: I already use FDE on my system drive (strong cipher, long unguessable password, etc.), but on the off-chance that my password is stolen or my computer is cold-booted, I want to prevent any potential adversary (assume one who’s skilled and resourceful, such as a hacker with knowledge of computer forensics) from learning about my more private activities on my computer – records of visiting certain websites, handling sensitive files (such as protected work documents), private communications, and so on.

The setup: I have VirtualBox installed on my (Host) machine using the standard installer and settings. I have a VM/Guest OS for those aforementioned private activities so that traces aren’t left on the Host (or at least aren’t immediately obvious – no “Recent Files” entries, browser history, etc). The Guest VDI (virtual hard drive) is stored in a separate, encrypted partition (which uses a different password from my Host’s drive).

(In case it may be relevant, the Host OS is Windows 8.1 Pro; the Guest OS is Windows 7 Ultimate.)

As I understand it, this setup means that when VirtualBox is shut down, the Guest OS is inaccessible without the password to its encrypted partition; however, VirtualBox may leave traces of its operation and my activities within it on the Host OS (such as log files, temporary files, registry entries, etc.). I do not know what information VirtualBox actually stores about the contents of its VMs or what users do with them, so I’m assuming the worst-case scenario: records of files opened and modified, websites visited, people communicated with, etc. (I know this is likely paranoid, but I’d rather be safe than sorry.)

My question: Is it possible to install or configure VirtualBox in such a way that it doesn’t leave any aforementioned traces (logs, temporary files, registry entries, etc.) on the Host OS drive? To be clear, I’m concerned less with hiding the existence of VirtualBox or the VM, and more with concealing the what I do within that VM when it’s running. If I can accomplish the latter, I’ll be satisfied.

One idea I had is to use Portable-VirtualBox, which claims to force VirtualBox to use relative paths for its files so that they’re all stored in the same directory Portable-VirtualBox is installed in (instead of “<User>\AppData” and so on). Using this in a VeraCrypt volume would be ideal for me, but I haven’t tested it yet, and at any rate I don’t know what traces Portable-VirtualBox may still leave behind on the Host OS.

(As to why I don’t use a bootable live system such as Tails, I’d prefer to still be able to use my regular OS at the same time without needing to shut one down to boot the other, hence why I want to use a VM if at all possible. I plan to purchase a separate computer in the future for all this, at which point a VM will no longer be necessary, but that’s not for a while.)

Please let me know if anything about my question is unclear. Thanks for any thoughts or advice.

Improve this question
7
  • The question contains nothing which makes it on-topic on information security. I recommend to move it to superuser.com.
    – Steffen Ullrich
    May 29, 2017 at 3:47
  • I don’t understand; how is preventing a potential adversary from snooping on my VM activities & related data not pertinent to InfoSec?
    – Walter
    May 29, 2017 at 4:33
  • It might be that you had an adversary in mind when writing this question. But there is nothing about this in your question. And, if you add it you would also need to add the assumed capabilities and goals of this adversary. See also XY problem.
    – Steffen Ullrich
    May 29, 2017 at 4:46
  • Would editing the question to read “to prevent a resourceful adversary from finding traces on the host and learning about my VM activities” make it more on-topic?
    – Walter
    May 29, 2017 at 4:51
  • It would be more on-topic but it would be too broad since it is unclear what resourceful exactly is (secret service?), what the goal of the attacker is and what you are trying to prevent by using the VM in the first place. For example it is not clear if not leaving log files will help at all against this attacker or why the existence of log files is a problem. And have you considered just booting another OS, maybe some read-only Linux system?
    – Steffen Ullrich
    May 29, 2017 at 4:53

1 Answer 1

Reset to default
1

The mere presence of a VDI (or vmdk) file is an evidence that the host contains a VM. Worse, depending on the configuration of the network, you may have special drivers that clearly state that you do use virtualization on this host.

I can only imagine 2 ways for hiding that:

  • the standard one is to have a simple normal VM and a hidden Operating System partition in that VM. You show that you use VirtualBox but hide what you do with it...
  • alternatively, you can use a portable installation on a removable media. When the removable media is not connected, you can pretend that you had used VirtualBox, but no longer use it.

Windows logging system is a pretty good tool, and virtualization may require special network drivers.So except if you know it well and carefully analyze all possible traces, I would not rely on the possibility of hiding any traces but more on just pretending the data you want is not there.

Improve this answer
1
  • Thanks for the reply. As stated in the OP (which I’ve tweaked for clarity), it’s less important for me to hide the presence of VirtualBox or the VM; I just don’t want anyone to be able to glean, from whatever traces VB leaves on the Host, what I do within that VM (similar to your first bulleted point). Also, the VDI is hidden inside its own encrypted partition (which uses a different password than my system drive does), so I’m not as worried about it being found and penetrated directly. Finally, pretending traces don’t exist wouldn’t help against a forensics expert determined to find them.
    – Walter
    May 29, 2017 at 7:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .