Remove bootable USB after live-booting from it

Question

I have a bootable USB (ADATA Superior Series S102 Pro 16GB USB 3.0 Flash Drive (AS102P-16G-RGY)) with MultiBootUSB (multibootusb.org) with non-persistent Ubuntu, KALI Linux, ParrotSec OS, Arch Linux, and Trinity Rescue Kit. However, if I boot any of those OSs', and then remove the USB drive, any programs that I haven't run so far will fail to run, the display will start flickering, and it will crash and show lots of cmdline outputs like:

[ 10.737654] cannot access <whatever>

Is there a way to load the entire OS (and all programs, files, etc.) from the USB to RAM so that it can be unplugged after the OS boots, without losing OS functionality? I've already tried the toram thing, the "RAM mode" option, and the "Load system to RAM" option.

I'd prefer a solution that works for all aforementioned OSs.

Answer 1

I have found a solution (may not work for all distros): Where it says "Try Ubuntu before installing" or "Try from this live CD", just press "E" to edit the kernel parameters. Then, there should be a line that ends like this: quiet splash --- or maybe quiet splash hostname=ubuntu --- Add toram (or toram=yes if that doesn't work) to that line, before the dashes, so it reads: quiet splash toram --- (with or without hostname) Press F10 or Ctrl + X to boot.

If it worked, then either the desktop or the file manager should have the USB mounted as a drive. Right-click and click "Eject", then remove the drive.

2023 update: This still works. I was also able to open the FAT32 drive in Windows and edit the file /boot/grub/grub.cfg to add a new menu entry (following the format of the other entries present) for toram booting (the second menuentry below is the custom addition):

menuentry "Try or Install Ubuntu" {
    set gfxpayload=keep
    linux   /casper/vmlinuz layerfs-path=minimal.standard.live.squashfs --- quiet splash
    initrd  /casper/initrd
}
menuentry "Ubuntu Live To RAM" {
    set gfxpayload=keep
    linux   /casper/vmlinuz layerfs-path=minimal.standard.live.squashfs --- toram noprompt
    initrd  /casper/initrd
}
menuentry "Ubuntu (safe graphics)" {
    set gfxpayload=keep
    linux   /casper/vmlinuz nomodeset layerfs-path=minimal.standard.live.squashfs --- quiet splash
    initrd  /casper/initrd
}

The noprompt argument prevents it from asking "remove live media and press Enter" when shutting down. You can also run sudo touch /run/casper-no-prompt when the system boots (I'm not sure if both are necessary, but I do both just in case).

The toram option only works with Ubuntu and a few other OSes.

Answer 2

This post may be related to your issue. If you want to create a custom Linux instance that loads boots into RAM this post appears to be a good start. You may also want to reference this post as well for additional information on the topic.

To answer your question, yes it is possible to create a Linux Live Boot that can be loaded into RAM. The operating systems and setup you are using does this. If you are looking for a guide on how to set up your own Live Boot, you can reference the links in the beginning of this post and conduct some research to figure out what works best for your use case.

However the second part of your question references removing the USB drive after your Operating System is loaded. You can set up your operating system to load into RAM allowing for removal of your USB device but any applications located on the device will not load as you found out. This is because they have not been loaded into RAM and the necessary files to start the application are still located on the drive that you removed. There is a way to do this but...

Is there a purpose to removing the USB device while you are using it? Setting up everything to be loaded and run off of RAM can work but without a drive to write changes to nothing will be persistent. Once you shutdown a computer that you have used a Live Boot on and removed the device there will be very little if any trace of the Live boot operating system. Once powered on and an operating system or some other kind of input is loaded into RAM all trace of the original Live Boot is gone as far as I know. There is no need to reinvent the wheel here, your setup does what you are asking just not the part about removing the drive while still in use.

Answer 3

+1 for putting the laptop to sleep/hibernate (I can't comment on someone else's comment stating just this, so I clog with new comment)

Maybe bad advice, but worked for me.

I put it to sleep, removed stick, dd to iso on another machine, put the stick back in, now I can load the iso into VM for analysis, and the bare metal machine didn't seem to notice

Ubuntu 18.04 LTS (18.04.5) running kernel 5.4.0-77-generic (uname -r).. doesn't match kernel table of 4.xx, but thats what it has, making my life reproducing this machine to compile a kernel module more difficult. It's a Lenovo malware machine if that makes a difference, bought just before the news of factory malware (possible vector, but later full-on backdoors) emerged.

Be advised this is temporary solution at best; if you are doing this to 'avoid the usb sticking out', depending on your power settings, it may take action that changes state when you don't want it to.

Cheers to maintaining ownership of your machine!

Answer 4

i managed to make my asus laptop operate just fine as long as i either removed the stick after it was put to sleep and even hybernate mode.. even once with battery dead.. recharged opened lid like nothing happened O_o... complete luck or mistake on the last. kali 2.0 sana live persistence and luks persistence asus model s550c series x64. only been able to reproduce result 5 times and only with laptop in full sleep and hybernation due to low batt. values