What traces are left after booting by usb?
- Is it true that a bootable Ubuntu USB drive does not allow anything to be written to the computer's hard drive?
- If so, would a computer with an SSD drive, like mine, also be left with no trace of a bootable USB session?
Many disks store a counter of power-on cycles, readable via SMART. (For example, in Windows one could use CrystalDiskInfo -- in all these screenshots you can read the "Power On Count" on the right hand side of the window https://www.google.com/search?q=crystaldiskinfo&source=lnms&tbm=isch)
This counter will be sensitive to booting off a different disk, but it won't be specific (the counter would also increase for entry to the BIOS setup screen, or a case where power was turned off again before loading the OS).
Because this counter is controlled by the drive's electronics, there is nothing that the Ubuntu software on the USB stick can do to prevent it from updating. It might be possible in some cases to clear or re-write the counter, but this would be specific to the disk model / firmware version and clearing the counter would still be detectable.
Some system BIOSes also keep a log of system events. I haven't seen one that records booting from removable media, but it is certainly feasible.
Of course you may also leave physical traces on the USB port itself, such as disturbing an oxidation layer.
Is it true that a bootable Ubuntu USB drive does not allow anything to be written to the computer's hard drive?
No. You can mount the disks and write all over them. After all, the USB stick is the main way Ubuntu users install Ubuntu for the first time.
But by default, Ubuntu won't mount anything you don't tell it to.
So if you didn't mount whatever partition "C:" is in reality, it would leave no trace of having been booted to Ubuntu.
Answer to 1.:
Ubuntu USB boot normally not even mounts the HDD/SSD of your system, and if mounted, it is read-only unless you tell Ubuntu to treat it as read and write.
Answer to 2.:
There will be no trace of an USB session unless you write to your HDD/SSD (see answer 1).
Be very careful of some answers on this page, It is very easy to write to and/or destroy the data on your internal drive(s) when running off of a Live or Persistent flashdrive..
I am using a pendrive install to write this, when I kook at Unity I see all of my internal partitions are mounted.
If I open gparted and want to modify, format or delete a partition, It generally first needs to be un-mounted.
While in gparted nothing needs to be un-mounted to create a new partition table and wipe the internal drive.
It can also be very dangerous to use dd from a flash drive, one very small error and everything on any drive can be wiped.
The answer to your second question is true, there may be no trace left of your bootable USB session or anything else.
No password is required for root permission on most Live and Persistent USB drives
Live and persistent installs are safe enough but learn the risks.