How do you know your files/documents aren't being written to the bootable USB?

[u/MarkTupper9]

/r/tails/comments/1x65ewk/how_do_you_know_your_filesdocuments_arent_being/

[u/candy49997]

If you did not set up persistence, nothing is written to disk.

[u/MarkTupper9 → u/candy49997]

Thank you. 

If i do enable persistence i believe its partition 2 for tails; to store a few documents that I DO want to persist will that negatively effect the behaviour of the non persistent data in the OS for example opening or saving docs in the non persistent desktop of the os will it leak onto the persistent partition 2 of the usb drive? 

[u/doc_willis → u/MarkTupper9]

If you use ventoy to make the USB and setup persistence, you can have several options on how persistence works. You could have persistent save files, or a persistent partition, and you can setup ventoy options for the distro you are booting to use one file, or another, or none at all. This is my experience with Ubuntu and Ventoy.

I cant say much about Tails as i never use it.

opening or saving docs in the non persistent desktop of the os

Thats not making much sense to me. You boot the USB (or iso) with Persistence enabled or not. Its not a 'persistent' desktop, its the OS that has the feature enabled or not.

Only the persistent partition would be writeable, the other parts holding the ISO would be read only.

Of course theres always other ways to setup these USB's that may differ.

You could even boot and installer usb and do a 'full normal' install to a second USB.

Some Distributions can even setup Persistence save files to other drives after they are booted/running. I recall TinyCore Linux and I think Puppy Linux have such options.

[u/MarkTupper9 → u/doc_willis]

Thank you that was great info.

I just meant for example that I read in comments, etc. that sometimes ubuntu live usb somtimes used the internal pc drive as some sort of swap or virtual memory if its detected. 

I wanted to ask if the same applies, if i enabled a persistent partition on the bootable usb with ubuntu/tails os.

Its importsnt to me no important document/file data 'leaks' especially unencryped. 

[u/doc_willis → u/MarkTupper9]

If there is a swap partition on an internal drive, I do believe I have seen some distros use that swap partition. But it might be an option you somehow setup.

However, I am not sure if ubuntu would do that by default, because what if you wanted to erase the internal drive, If your live usb was using the swap partition on that drive, you would encounter a problem.

You could likely run a command to trigger the USB to use an internal drive swap partition. sudo swapon /dev/sdXN

[u/MarkTupper9 → u/doc_willis]

Or I wonder if i enable persistent storage on usb that hss ubuntu/tails os can I make it read only after i finished placing documents in there? 

[u/guiverc]

It'll depend somewhat on how you wrote the ISO, as some software allows the ISO/image to be reformatted and thus written differently to the design.

The designed ISO 9660 file is READ ONLY, so cannot be written to; changes are made via COPY ON WRITE (COW) with the COPY existing in RAM; so that's were writes will occur; as any attempted to overwrite a correct image will just result in error (UNABLE TO WRITE!!! AS READ ONLY)

You can change this default behavior by writing the ISO/image using certain software that changes it, allowing persistence etc - but that's all done by the user anyway; and I'd expect the user would know they've reformatted the ISO/image and thus changed default behavior (besides that; most reformats write the persistence in a different partition on same thumb-drive anyway; so the ISO/IMAGE remains read-only anyway - but your ISO writing software will decide this!!)

I know this cannot happen normally as I'm the person who writes me ISOs to thumb-drive, and I'm using documented procedures that make it impossible. On the rare occasions when I'm reformatting an ISO during it's write to thumb-drive; again I'm aware of it. I just know as I'm the one who controls it.

[u/guiverc → u/guiverc]

If I picked up a thumb-drive and couldn't remember how it was written/created; I could always jump to terminal (assuming I'd booted it) and pretty quickly detect what its doing anyway; is it a READ ONLY image (how mounted is clue; type of file-system a huge clue; *squashfs* for example and not ext4), is it an installed system (writing to thumb-drive), mixture of *squashfs*/RO & persistence mount etc...) or not

If I hadn't booted it, plugging it in and exploring what is written can be done anyway; though as ISO 9660 is a very broad format (with distros/OSes varying what they rely on, with differences over time anyway!) that maybe more involved, but still perfectly possible.