Whonix Live-mode - Immutable Disk Method on VirtualBox

< Whonix Live
About this Whonix Live/Immutable Disk Method on VirtualBox Page
Support Status testing
Difficulty medium
Maintainer Algernon
Support Support

For VirtualBox there is also an alternate way to set the disks to read-only. This option is the official way for setting VM's to read-only in VirtualBox. However, it is a bit more complex to setup. This option will also only work with the grub-live package!

First read the footnote below. [1]

1. Backup.

Option 1: Create a snapshot of your VM. OR

Option 2: Alternatively backup the /boot folder.

sudo cp -a /boot /boot.back

2. Install grub-live.

Update the package lists.

sudo apt-get update

Upgrade the system.

sudo apt-get dist-upgrade

Install the grub-live package.

sudo apt-get install grub-live

The procedure of installing grub-live is now complete.

3. Reboot.

4. A second boot entry called "Whonix Live-mode" will be visible. Select it. Then press press Enter to boot the live system and use it as normal.

5. To make a disk on VirtualBox immutable / read-only, follow these steps:

  1. Power off the VM
  2. In the VirtualBox main window, navigate to: File -> Virtual Media Manager.
  3. Select the disk to write protect and release it.
  4. Click on Modify -> set it to Immutable.
  5. In the VirtualBox main window, navigate to the settings of the VM.
  6. Under storage, select the top controller and add the existing hard disk there.

6. The user can now boot the VM and select Live-mode.

7. To revert these changes:

Click on expand on the right.

  1. Power off the VM
  2. Navigate to: File -> Virtual Media Manager.
  3. Select the disk. It will now have a snapshot (~12.5 MB) attached to it.
  4. Release the snapshot and delete it.
  5. Click on Modify and set the hard disk to normal.
  6. In the VirtualBox main window, navigate to the settings of the VM.
  7. Under storage, select the top controller and add the existing hard disk there.


  1. VirtualBox implements hard disk write protection differently. If an immutable virtual machine is booted, VirtualBox will always create a snapshot where data is written. After shutting down and booting the VM again (a soft reboot is inadequate) the old snapshot will be deleted and a new one created. The consequence is that data will not persist in the VM, even if Live-mode is not selected. However, since the data is written to the hard disk of the host (instead of memory), it is easily recovered. Therefore, it is necessary to select Live-mode to be safe. A snapshot file is still created, but it will not store any altered content from the VM.

No user support in comments. See Support.

Comments will be deleted after some time. Specifically after comments have been addressed in form of wiki enhancements. See Wiki Comments Policy.

Add your comment
Whonix welcomes all comments. If you do not want to be anonymous, register or log in. It is free.

https | (forcing) onion

Share: Twitter | Facebook

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix, then Edit! IP addresses are scrubbed, but editing over Tor is recommended. Edits are held for moderation.

Copyright (C) 2019 ENCRYPTED SUPPORT LP. Whonix is a trademark.

Unless otherwise noted, the content of this page is copyrighted and licensed under the same Libre Software license as Whonix itself. (Why?)

Whonix is a licensee of the Open Invention Network.

Whonix is provided by ENCRYPTED SUPPORT LP. See Imprint.