Is VM on USB stick a good idea?

[Sony]

Hi all, I'm at the start of my journey so I must apologise for these extremely basic beginners questions.

My goal is to create a controlled environment where where my activities, residual files etc that are created within a virtual machine are confined on an external drive and totally separate to the host computer.

Using elements of this thread I've created a USB stick with a virtual machine on it and an OS partially installed on that machine, the VMDK file is on the host.
Is the VMDK file in the right place or should it also be on the USB?

Next, I'm unclear about how to use the USB stick. I keep seeing the term "Boot from the physical USB Drive" but I'm not sure what that means?
Do I simply boot the host computer in the normal manner, open the hosts virtualbox app, plug in the USB and boot the virtual machine on the USB?
Or am I supposed to use the USB to boot the host computer and then use the virtual machine on the USB?

Again I'm sorry the questions are so basic but I've spent two days searching for the answer without success.
Many thanks

[mpack]

What is the point of your USB stick? Locating the VM settings file on a USB doesn't add anything at all to the security of the host PC. The VirtualBox software and drivers still must be installed on the host, network I/O still passes through the host, etc.

Also, why VMDK? That is not the native format of VirtualBox - it doesn't support all features of a native disk, and if you damage the file then you're on your own. Repair expertise may be found on a VMWare site, but then again they may look askance at the fact you were using it with other software.

It seems to me that as a beginner you should take the easy route first. Make it more complicated once you're experienced enough to understand why that should be necessary.

[socratis]

I split the posts from the "[Howto] Create OSX ISO from the OSX Install app" thread, as it apparently had absolutely nothing to do with that. Created its own thread, with a (somewhat) more appropriate title.

@Sony,
You didn't mention host, guest, VirtualBox. Complete versions. Mind you, Win10 is *not* a complete version.
You didn't mention what or how you installed on the USB.
You didn't tell how you created the VMDK.
We need details, a lot more I'm afraind

[mpack]

I split the posts from ...

I already did that Socratis. Your duplication of that work seems to have messed things up. The topic I created disappeared and got renamed.

[socratis]

As they say in Greece, too many cooks burn the food.
You should have simply used the "Split topic" functionality, not create a topic and then copy/move the messages.

[Sony]

Gents, thanks for the reply, I apologise for any disruption, I thought my post was a natural extension of the topic, I stand corrected

Please keep in mind my earlier beginner comments, I have very little experience of Terminal & command

What is the point of your USB stick? Locating the VM settings file on a USB doesn't add anything at all to the security of the host PC. The VirtualBox software and drivers still must be installed on the host, network I/O still passes through the host, etc.

Due to local restrictions I was trying to create a totally anonymous browsing environment that left no residual traces of my activities on the host computer.
I was following the general guidance given in an article on security for beginners. It recommended the arrangements that I outlined earlier but did not give specifics.

VirtualBox-5.2.6 was successfully installed on the host.

Also, why VMDK? That is not the native format of VirtualBox - it doesn't support all features of a native disk, and if you damage the file then you're on your own. Repair expertise may be found on a VMWare site, but then again they may look askance at the fact you were using it with other software.

Until the end of my search I had been unable to find any OSX on OSX specific information. Everything was OSX on Windows.
I attempted to interpret those instructions for my OSX host.
The instructions called for a VMDK. I don't know enough to know if that's a sound or not but its what was instructed and so its what I created

It seems to me that as a beginner you should take the easy route first. Make it more complicated once you're experienced enough to understand why that should be necessary.

The instructions specifically called for creating a "bootable" USB stick with a virtual machine on it with OS X installed on the vm

You didn't mention host, guest, VirtualBox. Complete versions. Mind you, Win10 is *not* a complete version.
You didn't mention what or how you installed on the USB.
You didn't tell how you created the VMDK.
We need details, a lot more I'm afraind

Host is OS X 10.13.3 and has VirtualBox 5.2.6 installed on it
The USB is bootable and has files from an ISO file of the OSX10.13.3 installer, Virtualbox machine and OSX 10.13.3 on the VM
The VDMK file put itself into documents on the host computer
I used Tobi's web page as the basis along with elements from yourself and Tyler's page.
I had to do this because no single script worked entirely and I had many attempts before I was successfull
In hind sight I think this was because I had created several "failed files" and I was only successful when I located and deleted them.
As a result I can't tell you exactly how I did it

the VDMK was created using instructions at (I can't yet post links) innov8tiv dot com/boot-virtual-machine-usb-virtualbox-guide

[MacBook-Pro-2:~myname$ sudo VBoxManage internalcommands createrawvmdk -filename /Users/myname/Documents/myusbdrive.vmdk -rawdisk /dev/disk2s2

Password:

RAW host disk access VMDK file /Users/myname/Documents/myusbdrive.vmdk created successfully.

MacBook-Pro-2:~ myname$ sudo chmod 777 /Users/ollyagbebi/Documents/myusbdrive.vmdk
MacBook-Pro-2:~ myname$ sudo chmod 777 /dev/disk2s2
---
The required VMDK file will be located in 
/Users/myname/Documents/myusbdrive.vmdk.
---
sudo chmod 777 /Users/myname/Documents/myusbdrive.vmdk
---
The permissions for USB disk also need to be modified. Type
sudo chmod 777 /dev/disk2s2]

I hope that makes things a little clearer.

Once again, I apologise for any disruption that I caused and I thank you for your patience

[mpack]

As I alluded earlier, keeping the VM settings on the USB drive, and the VMDK on the host hard drive, is pointless, since the VMDK is the virtual hard disk and it will contain your browser history. Therefore anyone with access to your host can know what you were browsing. And if you want to get totally paranoid, your Internet Service Provider can create a log anyway of the sites you visit, even if you were running the browser from inside an encrypted VM that sits on a USB stick. So, I have to say that this entire enterprise seems a bit flawed.

Here's what I would suggest if you want real anonymity:
1. Use the "incognito/privacy" mode in your host web browser.
2. Also use a VPN service.

[Rootman]

So, to add further fuel to the fire. The VMDK file is the guests hard drives, leaving it on the host is contrary to your concerns. It should be on the USB stick.

Second, you should use the native VDI file that's Virtualbox uses as default. The choice is largely yours but as previously stated VDI is VB's native.

Thirdly, a USB stick? NO, sticks wear out faster and get write fatigue and performance is typically a lot slower. I'd use a USB HDD if you wanted to do this still. And be aware, someone can steal or seize the disk / stick and then your data is wide open just by mounting it on another VB system.

Fourthly, why not just use VB's encryption to protect the guests data and leave the VDI /VMDK on the host? Or you could use something like VeraCrypt to create a container and then put the guests files on that.

[Sony]

Thank you gents, both your posts have been most useful

keeping the VM settings on the USB drive, and the VMDK on the host hard drive, is pointless, since the VMDK is the virtual hard disk and it will contain your browser history. Therefore anyone with access to your host can know what you were browsing.

Thank you that helps a lot, I didn’t see the significance the first time that you said it.
Placing the VMDK where it is was just the product of a set of non related instructions and nothing to do with the whole anonymity goal. I didn’t want to move it until I understood what it did. And now I know, many thanks.

Here's what I would suggest if you want real anonymity:
1. Use the "incognito/privacy" mode in your host web browser.
2. Also use a VPN service.

Thanks for the suggestion but doesn’t using the browsers’ privacy mode make me reliant on Apple for my security? Or have I misunderstood it?

And if you want to get totally paranoid, your Internet Service Provider can create a log anyway of the sites you visit, even if you were running the browser from inside an encrypted VM that sits on a USB stick. So, I have to say that this entire enterprise seems a bit flawed.

Just because I’m paranoid doesn’t mean they’re not out to get me :0)
Thank you for the suggestion, the plan was outlined for me as
Me -> VPN -> custom secure browser -> custom Live system - all specifically designed to prevent tracking

The VMDK file is the guests hard drives, leaving it on the host is contrary to your concerns. It should be on the USB stick.
Second, you should use the native VDI file that's Virtualbox uses as default. The choice is largely yours but as previously stated VDI is VB's native.

Thank you, again on the first read I missed the significance of VDI over VMDK. I’ll make the change

Thirdly, a USB stick? NO, sticks wear out faster and get write fatigue and performance is typically a lot slower. I'd use a USB HDD if you wanted to do this still. And be aware, someone can steal or seize the disk / stick and then your data is wide open just by mounting it on another VB system.

I think the idea of the stick was for people who were up to no good and wanting to render it unserviceable very quickly. Not a concern of mine. And thank you for pointing out the security issues, I believe other tools & protocols take care of this.

Fourthly, why not just use VB's encryption to protect the guests data and leave the VDI /VMDK on the host? Or you could use something like VeraCrypt to create a container and then put the guests files on that.

The instructions specifically say to keep virtual box and the live system off the host drive because when they’re shut down the temp files whilst deleted are not permanently erased & therefore easily recoverable with the right tools.

Its all been pretty well thought through and used for quite some time and I have no reason, or experience for that matter, to challenge it.

Gents if I may, I'd like to draw you back to my original question. What’s the procedure for running the bootable USB?

[mpack]

Gents if I may, I'd like to draw you back to my original question. What’s the procedure for running the bootable USB?

First, let's not call it "bootable USB". That implies that VirtualBox cares what the host drive connection type is, and it doesn't.

There's no special arrangements needed for running a VM from a removable drive versus any other drive. Just create the VM then move it to whatever drive you like. Howto: Move a VM.

[Sony]

mpack Many thanks for the link. I look forward to reading it.

[socratis]

I think this thread is all over the place, mainly because "Sony" didn't clarify from the get go what was done:

As a result I can't tell you exactly how I did it

Well, reading back the whole thread:

• Sony has NOT clearly stated what their end goal is. From my understanding, they want to have a VM in a USB, so that when the USB is not there, the host won't have a clue of history, settings, etc.
• Sony created a bootable USB for their Mac. Most probably OSX was installed on that USB. But the installer, not the OS itself. Remember that this thread was split from the "[Howto] Create OSX ISO from the OSX Install app" thread. Unfortunately, Sony seems to be mixing a couple of things, taking snippets here and there and creating a not easy to follow procedure. Or an appropriate one, something that's going to work.
• The VMDK was *not* a virtual hard disk, similar to a VDI or a VHD. The VMDK was created with the "rawdisk" option, aka pointing to a physical disk; the USB in our case. Moving a VM, creating a VDI or other such advice is not applicable in this case.

Sony,
Please tell us what you want to do. Not what you believe the steps should be, based on a couple of unknown quality websites. The way I'm reading this, there are two things that you can do:

1. Create a VM that is stored in the USB. Not a raw-access VM, but a normal VDI which simply resides on the USB, along with Snapshots and Logs. See mpack's advice. No USB? No VM. There are problems with this approach as outlined in the post from Rootman. I've done this, but with a 2.5" ext. HD, not with a stick for wear issues.
2. Create a bootable USB disk and access that with a rawdisk VMDK, which *has to* reside on your host, it doesn't work otherwise. I don't know why you would choose this option, if not for using the USB to also boot your host whenever you want to. I've also done that with a 10.13 VM, that can either boot my Mac or used as a VM. But I'm not sure why you want to do that either.

So, please clarify what you want to do, what your guest is going to be. And most importantly if you want the USB to be a standalone bootable USB for your computer or not. That means rebooting your host and booting from the USB (holding Opt. Not a bootable VM, a bootable USB. Huge difference...

[Sony]

Sony has NOT clearly stated what their end goal is.

My goal is to create a controlled environment where where my activities, residual files etc that are created within a virtual machine are confined on an external drive and totally separate to the host computer.

From my understanding, they want to have a VM in a USB, so that when the USB is not there, the host won't have a clue of history, settings, etc.

Your understanding is absolutely correct

Sony created a bootable USB for their Mac.

I tried to but it turns out that I was unsuccessful in creating a VM on the USB, the account was created on the host drive. Subsequent attempts gave the same result

My steps were:

• downloaded OS X 10.13.3 installer
  created an OS X 10.13.3 installer usb
  created an iso file for the OS X 10.13.3 installer & put in on the host (I also tried it on the USB)
  created a vmdk file on the USB, (I did this because I couldn’t find a way to create the VM on the USB w/o having a vmdk file to point to)
  created the VDMK file using http://www.sysprobs.com/mac-os-x-host-b ... virtualbox
  created a VM pointing it at the vmdk on the USB
  created the VM using Tobi’s page
  pointed the vm at the iso file on the host drive (did the same for the usb drive)
  deleted the vmdk file from the USB
  ran the new vm which went to OSX install screen
  unfortunately the VM was created on the host drive

Sony seems to be mixing a couple of things, taking snippets here and there and creating a not easy to follow procedure.

You are correct. At the time I was unable to find a "how to" on creating a bootable USB that ran OSX 10.13.3 as a host and as guest

So, please clarify what you want to do

I would like to run a Virtual Box and from a USB stick
I would like to arrange it so that when the USB is not there, the host won't have a clue of history, settings, etc
I would like to run OS X 10.13.3 & a version of linux as guests in the manner described

[socratis]

You made a mashup of instructions for 1) creating the OSX installer on a USB stick, 2) accessing/booting an OS on a bootable USB via rawdisk, and 3) storing a VM on a USB stick. Forget about all of them for a minute.

I would like to run a Virtual Box and from a USB stick

As I said you have two options. You need to tell me which one you'd like. Run the VM from a stick, or simply store a VM on a stick. Both are problematic.

I would like to run OS X 10.13.3 & a version of linux as guests in the manner described

If you want to dual-boot your Mac from a dual-boot USB stick, this is not the place to ask. I haven't seen anything like that, so I don't have any pointers.

On the other hand, if you want to store two VMs on a USB stick, that's a different problem. For existing VMs you move them to the stick. For new ones, you change the VirtualBox Preferences » General » Default Machine Folder, to point to your USB.

[Sony]

you have two options. You need to tell me which one you'd like. Run the VM from a stick, or simply store a VM on a stick.

Which option will allow me to achieve the situation where when the USB is removed, the host won't have a clue of history, settings, etc?

If you want to dual-boot your Mac from a dual-boot USB stick, this is not the place to ask.

I'm not trying to do this

On the other hand, if you want to store two VMs on a USB stick, that's a different problem. For existing VMs you move them to the stick. For new ones, you change the VirtualBox Preferences » General » Default Machine Folder, to point to your USB.

Thanks for the pointer on preferences. Will creating new or moving existing VMs to a USB keep the history, settings, etc separate from the host?