Ubuntu – What traces are left after booting by usb

bootdrivehard driveSecurityusb

  1. Is it true that a bootable Ubuntu USB drive does not allow anything to be written to the computer's hard drive?
  2. If so, would a computer with an SSD drive, like mine, also be left with no trace of a bootable USB session?

Best Answer

Many disks store a counter of power-on cycles, readable via SMART. (For example, in Windows one could use CrystalDiskInfo -- in all these screenshots you can read the "Power On Count" on the right hand side of the window https://www.google.com/search?q=crystaldiskinfo&source=lnms&tbm=isch)

This counter will be sensitive to booting off a different disk, but it won't be specific (the counter would also increase for entry to the BIOS setup screen, or a case where power was turned off again before loading the OS).

Because this counter is controlled by the drive's electronics, there is nothing that the Ubuntu software on the USB stick can do to prevent it from updating. It might be possible in some cases to clear or re-write the counter, but this would be specific to the disk model / firmware version and clearing the counter would still be detectable.

Some system BIOSes also keep a log of system events. I haven't seen one that records booting from removable media, but it is certainly feasible.

Of course you may also leave physical traces on the USB port itself, such as disturbing an oxidation layer.