Title: Advanced forensic analysis of Tails operating system and its implication to cybercrime in deep and dark web

Authors: Ngaira Mandela; Amir Aboubakr Shaker Mahmoud; Animesh Kumar Agrawal; Nilay R. Mistry

Addresses: School of Digital Forensics and Cyber Security, National Forensic Sciences University, Gandhinagar, India ' School of Digital Forensics and Cyber Security, National Forensic Sciences University, Gandhinagar, India ' School of Digital Forensics and Cyber Security, National Forensic Sciences University, Gandhinagar, India ' School of Digital Forensics and Cyber Security, National Forensic Sciences University, Gandhinagar, India

Abstract: The Tails operating system, renowned for its emphasis on privacy and anonymity, has become a preferred choice for individuals seeking to safeguard their online activities. Tails OS design centres around providing a secure environment that leaves minimal traces, thereby attracting privacy-conscious users. However, this very secure design also entices cyber criminals operating in the digital landscape, to use Tails to perpetrate illicit activities, creating new challenges for digital forensics practitioners in their pursuit of extracting evidence. This paper conducts an exhaustive forensics of Tails operating system, aiming to uncover the digital remnants left behind during its utilisation. By analysing the RAM, network, disk, and virtualisation, employing a range of activities and forensic tools, many artefacts are unearthed that provide insight into user interactions within the Tails environment. This research contributes to our understanding of the interplay between privacy preservation and digital evidence recovery, shedding light on the complexities of investigating a privacy-focused operating system like Tails.

Keywords: Tails operating system; amnesic incognito live system; privacy-focused OS; anonymity; cybercrime; digital forensics; deep and dark web.

DOI: 10.1504/IJESDF.2025.149328

International Journal of Electronic Security and Digital Forensics, 2025 Vol.17 No.6, pp.689 - 709

Received: 05 Sep 2023
Accepted: 13 Nov 2023
Published online: 27 Oct 2025 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article