Tails OS 7.0: The Anonymous Operating System Guide

Tails (The Amnesic Incognito Live System) is a Debian-based operating system designed to be booted from a USB drive, leaving no persistent trace on the host computer. Version 7.0 represents the most significant update to the platform in several years, introducing new security hardening and usability improvements. This article covers the key changes and serves as an overview guide for new and existing users.

What Is New in Tails 7.0

Tails 7.0 ships several notable improvements over the 6.x series:

• Updated Linux kernel: The 7.0 kernel provides updated hardware support, particularly for newer CPU architectures, and closes several kernel-level privilege escalation vulnerabilities present in earlier builds.
• Persistent storage encryption upgrade: The underlying encryption for persistent storage has been updated to use LUKS2 with Argon2id key derivation, replacing the older LUKS1/PBKDF2 combination. Argon2id is memory-hard and significantly more resistant to GPU-accelerated password cracking.
• Tor Browser 14 integration: Tails 7.0 ships with Tor Browser 14 as the default browser, incorporating all the security improvements detailed in our earlier analysis.
• Improved Wayland support: The graphical environment now runs fully on Wayland, providing better display isolation between applications and preventing certain X11-based screen scraping attacks.
• OnionShare integration: Tails 7.0 integrates OnionShare as a first-class application, allowing anonymous file transfer and web hosting directly from the live session.

Creating a Bootable Tails USB

Creating a Tails USB requires a USB drive of at least 8 GB. The recommended process:

1. Download the Tails ISO image from tails.boum.org — always verify the OpenPGP signature or use the official Tails Verification browser extension before proceeding.
2. Use the Tails Installer application (on an existing Tails installation), balenaEtcher, or the official dd-based method to write the image to the USB drive.
3. Boot the USB drive on the target machine by selecting it from the BIOS/UEFI boot menu.
4. On first boot, configure the welcome screen options: language, keyboard layout, and whether to enable persistent storage.

Tails Persistent Storage

By default, Tails stores nothing between sessions — every reboot starts from a clean state identical to the original image. However, many use cases require retaining data across sessions: PGP keys, browser bookmarks, custom application configurations, or documents. Persistent storage provides this capability while maintaining encryption.

Persistent storage is stored in a LUKS2-encrypted partition on the same USB drive. When enabled, Tails prompts for the persistent storage passphrase at boot. Only the selected categories of data (configured by the user) persist; everything else is still amnesic. The passphrase protection means that even if the USB drive is physically seized, the persistent data is not accessible without the passphrase.

Why Tails Leaves No Trace

The amnesic property of Tails derives from its RAM-only operation. The entire live system runs in volatile memory. When the machine powers off or the USB is removed, RAM is cleared (on most hardware, within seconds) and no data is written to the host machine's storage drives. This design means Tails can be used on a shared or untrusted computer without leaving forensically recoverable artifacts.

Tails vs Standard OS with Tor Browser

A standard operating system running Tor Browser provides Tor network access but does not address the host OS threat surface. The host OS can contain malware, keyloggers, or forensic artifacts from previous browser sessions. A motivated attacker with access to the device can recover browsing history, DNS query logs, and connection metadata from the underlying OS even if Tor Browser itself leaves minimal traces. Tails eliminates this entire category of risk by running from a clean, verified, isolated environment with each session.