qubist
October 8, 2026, 2:11pm
2
What could a forensic analyst collect from the system to obtain metadata?
After qube deletion, some log files and .menu files remain on the filesystem, as well as whatever is stored in dom0’s journal about that qube. Check the cleanup script in this thread that handles removal of logs and menus. You can set your dom0 journal to volatile, so it remains in RAM only.
Not an anti-forensic solution. Just a way to keep your system clean.
If you make system journal volatile, it won’t survive rebooting. In your template:
sudo sed -ri 's/#Storage=.*/Storage=volatile/g' /etc/systemd/journald.conf
For rotating, read man journalctl.
Xen and Qubes specific logs are separate from system journal.
So if police comes and takes my pc the logs are not understandable
They have to decrypt your drive first. If they do this, your logs are your smallest concern.
Qubes is not privacy or anti-forensics focused.
@James369
Consider this explanation:
and the man page of journald.conf:
Storage=
Controls where to store journal data. One of "volatile",
"persistent", "auto" and "none". If "volatile", journal log data
will be stored only in memory, i.e. below the /run/log/journal
hierarchy (which is created if needed).
Could you please explain what forensic traces in dom0 you are concerned with?
Encrypted RAM not only for cold-boot attacks, side-chain …
If Qubes doesn’t retain logs that identify the source VM and NetVM for each disposable VM, would using disposable VMs with ephemeral_volatile=True provide strong anti-forensic protection?
Qubes is not an anti-forensic OS.
3 Likes