Say I have a computer with 2 operating systems: one secure, one... not so much.

Now say I want to use the insecure system to do some work I can't do on the secure one. What is the best way to isolate the 2 systems so that if one system goes completely nuts the other system cannot be harmed in any way, shape, or form?

  • 1
    would you be able to elaborate on what work you are trying to do?
    – CtrlDot
    Mar 11, 2014 at 17:00
  • Try qubes-os.org/trac . It's designed exactly for what you need.
    – Matrix
    Mar 12, 2014 at 7:03

4 Answers 4


Given the "only one computer" restriction, the best way is to have your "insecure" OS purely on a write only medium like a 100% full CD, DVD, or Blu-Ray. This, however, can be very cumbersome and annoying (though it is very cheap).

Disconnect the hard drive completely before booting off the optical media.

The next best way is to have 100% separate hard drives - something like a hot swap capable bay or dock makes this very easy to deal with.

Encrypt both of them with different keys (which should automatically happen with Checkpoint or Linux's built-in LUKS or Truecrypt on Windows), and ideally with separate passphrases.

Note that most encryption, particularly most system boot encryption, does NOT encrypt the boot record/MBR/boot partition - it must have an unencrypted area to bootstrap the encryption from, and this is a place malware can host itself in, too (plus the Evil Maid). You could destroy that data from read-only media every time, and then boot with a recovery disk each time; that's also very cumbersome.

Use only one at a time. Never ever have both connected at the same time. Shut the system down, cold, before switching them - for half an hour or more at a time if you're truly worried (or do a RAM test off of a boot CD in between)

You are still vulnerable to a variety of threats; if at all possible, remove all networking physically when you're doing this unidentified work you're worried about doing on the insecure box - otherwise you're still vulnerable to network based threats.

If you want another layer, in both of them, use a virtual machine to do work that's actually sensitive - encrypt that OS separately if you like, and only decrypt it when you're going to use it.

BIOS based threats are still going to be shared, of course, as well as any hardware based threats (hardware keyloggers and the like at the low end).

  • Sorry for not answering been away: "Shut the system down, cold, before switching them - for half an hour or more" Why wait half-hour or more?
    – user36976
    Mar 22, 2014 at 10:39
  • To reduce the risk of a cold boot attack working - essentially, DRAM, if not wiped, retains contents for longer than you might expect. Colder RAM retains contents longer, but that won't matter in your case. Mar 22, 2014 at 14:16
  • Doesn't the system automatically clear the RAM when its assigned to a process/needs to be used?
    – user36976
    Mar 22, 2014 at 14:18
  • Read the paper I linked to above, where it discusses that - boards with ECC capability tend to do that, consumer boards don't tend to. In your particular case, run a test - pull up a RAM hex editor, for instance Hxd for Windows, put a pattern on some RAM (like a large BMP with consistent areas), use the hex editor to find it and record what's there; translate this into bits. Then do a very fast poweroff/poweron, return to that RAM location, again record and translate to bits. See if it looks cleared out! If not, check # of identical bits vs. random chance. Mar 22, 2014 at 14:23

With this kind of configuration, there will always be a level of risk as they have shared resources which could be compromised.

Probably the main area of concern would be the BIOS of the machine which could, theoretically, have malware installed which would be active when the "secure" OS was booted.

Two approaches that spring to mind to minimize the risk.

  1. Use a VM for the insecure OS, as suggested by @ponsfonze. The risk here could be that malware on the insecure VM could try to get access to the host, either through shared resources (e.g. if you map drives from the host to the guest) or a vulnerability in the VM software used (e.g.this one)

  2. Use Full Disk Encryption on the partition hosting the "secure" OS. That reduces the risk of the insecure OS getting access to it's files, but still leaves potentially the BIOS problem.


If you are running the 2 OSes on the same physical system there will always be some risk of the 2 systems affecting each other. The safest way would be to run them on 2 separate physical volumes. There are a few different ways to do this, but I think the easiest is to install your unsafe system on a bootable usb, which doesn't have access to your safe system's volume or disk.


One approach would to use a virtual machine for the second operating system. This is probably the easiest to implement, but may not be an exact fit to your question because the second operating system may be able to exploit the vm software and 'go nuts' on the host machine.

Another way may be to have both of the operating systems encrypted with seperate keys, that one system wouldn't be able to read or modify the data in any meaningfull way. One system may be able to format the other disk or partition, but of course you can just restore it from your backup.

An interesting thing that comes to mind is using a hidden operating system. The first operating sytem would not be able to detect the hidden operating system, but of course it may decide to delete itself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.