12
  1. Is it true that a bootable Ubuntu USB drive does not allow anything to be written to the computer's hard drive?
  2. If so, would a computer with an SSD drive, like mine, also be left with no trace of a bootable USB session?
Improve this question

6 Answers 6

Reset to default
20

Many disks store a counter of power-on cycles, readable via SMART. (For example, in Windows one could use CrystalDiskInfo -- in all these screenshots you can read the "Power On Count" on the right hand side of the window https://www.google.com/search?q=crystaldiskinfo&source=lnms&tbm=isch)

This counter will be sensitive to booting off a different disk, but it won't be specific (the counter would also increase for entry to the BIOS setup screen, or a case where power was turned off again before loading the OS).

Because this counter is controlled by the drive's electronics, there is nothing that the Ubuntu software on the USB stick can do to prevent it from updating. It might be possible in some cases to clear or re-write the counter, but this would be specific to the disk model / firmware version and clearing the counter would still be detectable.

Some system BIOSes also keep a log of system events. I haven't seen one that records booting from removable media, but it is certainly feasible.

Of course you may also leave physical traces on the USB port itself, such as disturbing an oxidation layer.

Improve this answer
3
  • this counter is controlled by the drive's electronics precisely the disk firmware.
    – heemayl
    Dec 20, 2016 at 3:29
  • Of course it has be cycled, a reboot does not count ?
    – mckenzm
    Dec 20, 2016 at 3:58
  • 2
    @mckenzm: Depending on the power system design, a reboot might or might not involve briefly removing power from peripherals such as disks, and depending on the disk controller design, there might be sufficient capacitance to carry it through a short removal of power.
    – Ben Voigt
    Dec 20, 2016 at 16:18
18

Is it true that a bootable Ubuntu USB drive does not allow anything to be written to the computer's hard drive?

No. You can mount the disks and write all over them. After all, the USB stick is the main way Ubuntu users install Ubuntu for the first time.

But by default, Ubuntu won't mount anything you don't tell it to.

So if you didn't mount whatever partition "C:" is in reality, it would leave no trace of having been booted to Ubuntu.

Improve this answer
9
  • 6
    Does this remain true of there is a usable swap partition on the SATA drive?
    – kasperd
    Dec 19, 2016 at 14:39
  • 1
    @kasperd: systemd-gpt-auto-generator will check a GPT and auto-detect swap partitions, but it only checks the "root disk". It would be rather bad if a system accidentally used swap space from a removable volume. But you can rely on the root volume being non-removable.
    – MSalters
    Dec 19, 2016 at 15:23
  • 6
    I tested on a VM with Ubuntu 16.04 (64 bit, UEFI mode) installed which has a separate 4GB swap partition. Booting that VM from a 16.04 iso image (installation/live DVD) will result in a live system with the disk's swap partition mounted and activated automatically. I don't know how the live system decides which swap partitions to mount, but it definitely does it sometimes.
    – Byte Commander ♦
    Dec 19, 2016 at 16:34
  • 1
    If it uses the swap partition, too bad if hibernation data was stored in it.
    – mckenzm
    Dec 20, 2016 at 3:58
  • 1
    The information (warning) about swap should be edited into the answer.
    – Jonas Schäfer
    Dec 20, 2016 at 16:53
3

Answer to 1.:

Ubuntu USB boot normally not even mounts the HDD/SSD of your system, and if mounted, it is read-only unless you tell Ubuntu to treat it as read and write.

Answer to 2.:

There will be no trace of an USB session unless you write to your HDD/SSD (see answer 1).

Improve this answer
3
  • I am understanding from these good answers that SSD drives are just as immune to unwanted traces as HDD drives when booting by USB. Nice to know.
    – Seeker
    Dec 19, 2016 at 14:02
  • Well if you write to your SSD then there might be traces too, thought that it was needless to say but will update my answer accordingly.
    – Videonauth
    Dec 19, 2016 at 14:09
  • 4
    I would say that there are no difference in immunity to unwanted traces between SSD and HDD .
    – Soren A
    Dec 19, 2016 at 14:13
2

Be very careful of some answers on this page, It is very easy to write to and/or destroy the data on your internal drive(s) when running off of a Live or Persistent flashdrive..

I am using a pendrive install to write this, when I kook at Unity I see all of my internal partitions are mounted.

If I open gparted and want to modify, format or delete a partition, It generally first needs to be un-mounted.

While in gparted nothing needs to be un-mounted to create a new partition table and wipe the internal drive.

It can also be very dangerous to use dd from a flash drive, one very small error and everything on any drive can be wiped.

The answer to your second question is true, there may be no trace left of your bootable USB session or anything else.

No password is required for root permission on most Live and Persistent USB drives

Live and persistent installs are safe enough but learn the risks.

Improve this answer
1

A live Ubuntu USB session leaves no traces whatsoever on the hard drive of the computer it is booted on unless Ubuntu is installed on the hard drive from the live USB session, and installing Ubuntu from an Ubuntu live USB or making changes to the computer's hard drive is not necessary, only optional.

Improve this answer
3
  • 6
    You can mount and write on local disks, without installing Ubuntu, so your answer is wrong.
    – Soren A
    Dec 19, 2016 at 14:12
  • When I boot a Live or persistent flash drive most all partitions on the computer are already mounted. In gparted it is necessary to unmount most partitions before deleting, formatting, or shrinking. It is not necessary to unmount anything to create a new partition table and wipe the internal drive.
    – C.S.Cameron
    Dec 20, 2016 at 1:47
  • 1
    In fact one of the popular reasons for mounting a live distro is to re-image the internal disk from a clone or a master, and if it is a windows disk, to delete or rename certain files. It is, however, possible to leave no trace. If in doubt, open the box and unplug the disk.
    – mckenzm
    Dec 20, 2016 at 4:02
0

I found the differences in answers on this page puzzling and decided to do a quick comparison between bootable USB install types using Ubuntu 16.04.1 64bit Desktop:

  • Full Install using Ubiquity.

  • Live syslinux Install using Startup Disk Creator.

  • Persistent grub2 install using mkusb / dus

Live and Persistent installs had the same characteristics except as noted.

Full Install, (FS) vs Live/Persistent Install, (L/P)

USB OS automatically mounts all partitions* - Full - yes, L/P - yes

Internal partition writable without SU - Full - yes, L/P - no

Internal partition writable with SU - Full - yes, L/P - yes

Super User requires password - Full - yes, L/P - no

Gparted requires password - Full - yes, L/P - no

Install to internal drive requires password - Full - N/A, L/P - no

Uses internal drive's swap space, (if available) - Full - yes, L/P - yes

Uses internal drive's casper-rw partition, (if available) - Full - N/A, Live - no, Persistent - yes.

As long as the computer does not have a swap partition, a casper-rw partition, you are careful where you save things, you do not use gparted, boot-repair, click the install icon, type "sudo" or "dd" or try to back anything up, you should be OK. If it as a Live USB, (without persistence), and the internal drive is Windows just don't type "sudo" or use any utilities.

All results in this review can be easily duplicated.

  • ISO9660 partitions are mounted but are read only images., as is the cdrom folder.
Improve this answer
5
  • Would you be so kind as to translate that into layman's language? The question I sought to have answered, qualified now in response to this flood of answers, was simply this: if I run Ubuntu on a USB and do nothing whatsoever to access the computer's HDD or SSD, can any trace of my activity be leaked onto them?
    – Seeker
    Dec 21, 2016 at 12:41
  • 2
    As long as the computer does not have a swap partition, a casper-rw partition, you are careful where you save things, you do not use gparted, boot-repair, click the install icon, type "sudo" or "dd" or try to back anything up, you should be OK. If it as a Live USB, (without persistence), and the internal drive is Windows just don't type "sudo" or use any utilities.
    – C.S.Cameron
    Dec 22, 2016 at 1:10
  • 1
    @C.S.Cameron You're comment above is the actual answer: As longer as there are no swap or casper-rw and nothing else gets mounted, explicitly or inadvertently, a live session won't touch the internal drives. Otherwise, it may, may being the operative word here. Even so, swap is not preserved and any traces of usage during a live session aren't "visible" to anyone but forensic specialists.
    – user589808
    Dec 22, 2016 at 22:51
  • The answer to the OP's question No 1 is, no it is not true, Ubuntu does allow things to be written to a computer's hard drive. No 2 is also not true, the computer can be left with many traces of the USB session, including a new operating system. The OP has qualified his question and the new answer is, that the internal drive is safe as long as the user is careful and knows what he is doing, I wiped out the hard on a work computer just one month ago, but I am not careful and I like to experiment.
    – C.S.Cameron
    Dec 23, 2016 at 0:41
  • Thank you CelticWarrior I have added that comment to my answer.
    – C.S.Cameron
    Dec 23, 2016 at 3:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .