Tails OS

Tails OS is an amnesic live operating system that runs from a USB drive and leaves no trace of its use on the host computer. All network connections are automatically routed through the Tor anonymization network, and all data is stored in RAM — when the computer is shut down, Tails erases all traces of the session unless the optional persistent storage is used.

For OSINT investigators, Tails provides the most accessible high-security investigation environment for sensitive operations. The combination of Tor routing for all traffic and RAM-only storage means that investigation activity leaves no forensic trace on the host machine and all network traffic is anonymized through Tor — two critical operational security properties in a single bootable package.

Investigators conducting research on hostile subjects, infiltrating closed online communities, or working cases where operational security failure could have serious consequences use Tails to ensure that their investigation environment cannot be forensically examined and that their internet connection cannot be traced.

Tails comes pre-installed with Tor Browser, Onion circuits visualization, PGP email encryption tools, KeePassXC for credential management, Metadata Anonymisation Toolkit (MAT) for stripping file metadata before sharing, and other privacy and security tools relevant to investigation workflows.

The amnesia property means every Tails session starts fresh — with clean browser fingerprints, no accumulated cookies, and no investigation history. This fresh-session property prevents behavioral fingerprinting that tracks browser behavior over multiple sessions.

Optional encrypted persistent storage allows investigators to retain specific files, configuration, and bookmarks across sessions while maintaining all other amnesic properties. The persistence volume is encrypted and requires a separate passphrase.

For law enforcement and authorized investigators, Tails supports documentation of investigation activities with timestamped evidence capture that can be preserved to the persistent storage.

Document Tails version used, whether persistence was enabled, and the investigation activities conducted in each session.