What remains in dom0 after deleting a qube, and which hardening guides are reliable?

User Support General
1

Hi everyone,

I’m trying to better understand what happens in dom0 when a qube is deleted. I know that the qube’s private storage should be removed, but I’m wondering whether anything may still remain in dom0, such as, storage-pool metadata, logs, shell history, journal files, backups, snapshots, crash dumps, or cached data.

  1. What is the recommended and safe way to investigate and clean up any remaining traces of a deleted qube in dom0? I’m especially interested in methods that do not risk damaging Qubes’ storage pools or manually editing important system files.

  2. Are there any reliable, currently maintained guides for hardening Qubes OS? I’m looking for practical guidance on dom0 hardening, minimizing metadata leakage, managing backups and logs, storage encryption, disposable qubes, firewall policies, and safe update procedures.

Thanks in advance. I’m mainly looking for a safe, supported approach rather than aggressive file deletion or commands that could corrupt the Qubes installation.

2

After qube deletion, some log files and .menu files remain on the filesystem, as well as whatever is stored in dom0’s journal about that qube. Check the cleanup script in this thread that handles removal of logs and menus. You can set your dom0 journal to volatile, so it remains in RAM only.

Not an anti-forensic solution. Just a way to keep your system clean.