Volatile Memory Forensics of Tails OS in a Virtualized Environment
Publication Date
1-1-2026
Document Type
Conference Proceeding
Publication Title
Proceedings of the International Symposium on Digital Forensics and Security Isdfs
Issue
2026
DOI
10.1109/ISDFS69419.2026.11459100
Abstract
Operating systems focused primarily on privacy, such as Tails, are designed to minimize forensic traceability through the elimination of permanent storage and reliance on a non-persistent execution model. This study examines the availability of forensic traces retained in volatile memory, specifically within the non-persistent, virtualized environment of Tails. A controlled experiment involving normal user activity was conducted, followed by live RAM data acquisition and analysis using FTK Imager, Volatility 3, and keyword-based extraction techniques. The results demonstrate that traces related to file system activity, network communications, software execution, and external device interaction persist in temporary memory. These findings highlight Tails' forensic visibility beyond its documented threat model and underscore the evidentiary value of live memory analysis in privacy-focused operating systems.
Funding Number
2304753
Funding Sponsor
National Science Foundation
Keywords
Digital Forensics, OS Forensics, Tails Forensics
Department
Justice Studies
Recommended Citation
Nurettin Senol, Jayden Thai, Semih Cal, and Ahmet Aydogan. "Volatile Memory Forensics of Tails OS in a Virtualized Environment" Proceedings of the International Symposium on Digital Forensics and Security Isdfs (2026). https://doi.org/10.1109/ISDFS69419.2026.11459100
