Anti-Forensics: Utilizing /dev/shm in appvm and disposables for Maximum Security in Qubes

User Support General
1

Exploit Shared Memory: Secure Deletion in Qubes with /dev/shm to Thwart Forensic Attacks!

In the realm of Qubes OS and Whonix, making sure your sensitive files are handled securely is paramount. When dealing with temporary files for analysis or document production in AppVMs or DisposableVMs, utilizing /dev/shm (shared memory) proves to be a compelling solution.

The Risks of Traditional Deletion Methods

  1. SSD Secure Erase Limitations:

    • Research indicates that secure erase options on SSDs are not always trustworthy, especially when TRIM is involved.

  2. HDD Performance Issues:

    • While using shred on HDDs can effectively delete files, performance in Qubes can lag, even on high-end systems.

The Power of /dev/shm

Storing files in /dev/shm ensures that they remain volatile; once the AppVM or DisposableVM is shut down, all files in this temporary memory are eradicated. This approach mitigates risks of forensic recovery altogether, safeguarding your sensitive information.

Key Considerations

  • However, there are questions regarding Qubes’ handling of unsaved drafts. If you’ve previously encountered a prompt to recover unsaved files upon a restart, it raises concerns about whether files in /dev/shm might inadvertently be saved or cached.

  • Does Qubes have built-in mechanisms to preserve unsaved drafts that could compromise the intended anonymity and deletion effectiveness?

Your Inquiry for Support

  1. Is it definitively secure to write files to /dev/shm in AppVMs and DisposableVMs without potential recovery?
  2. Are there underlying Qubes mechanisms that might inadvertently save volatile files?

The Bottom Line

Utilizing /dev/shm for temporary file storage in Qubes can significantly bolster your defense against forensic recovery. Clarifying the nuances of Qubes’ file handling will fortify this approach and improve your overall security stance.

Awaiting expert responses!

2

Hello.
You need to activate Qubes’ built-in feature for ephemeral encryption of volatile and root volumes, then remount all private volume directories to /dev/shm to guarantee complete anti-forensics. This guide implements the best path for anti-forensics:

You can use full ephemeral encryption or run the appVM entirely in RAM. In the next version of Qubes, an anti-forensics feature for appVMs should appear by default thanks to the kicksecure devs:

2 Likes