"Hidden Whonix" Guide

File, Image and Video Downloader

Want to queue up large or multiple files, image URLs, or video links to download in the background, with pause and resume functionality across reboots or connection time-outs and with full archive and password auto-extract capability?

Use JDownloader.

To install:

1. Go to JDownloader's official download page and click on the Download Installer (x64) link under Linux. It will take you to the official MEGA download link for the file, which is a Linux bash script (.sh).

2. In Thunar File Manager, find the downloaded file JD2Setup_x64.sh. Right-click on it and select Properties... > Permissions and tick Allow this file to run as a program then click Close. Now right-click on the file, select Open With > Open With Other Application... and scroll down to select Terminal Emulator. It will take you through a GUI installer. Follow all prompts like Next to complete the installation.

3. Next, download this official beta mod (it's a useful bugfix for some archive files failing to auto-extract in JD). Choose the Linux 64Bit only MEGA link. Extract the ZIP in Thunar File Manager and copy its two files (sevenzipjbinding1509.jar and sevenzipjbinding1509Win.jar) into the folder ~/jd2/libs. Restart JDownloader if it's open, and now it's ready to use.

You can now customize and tweak JDownloader in many powerful and useful ways.

To make the downloading experience more clean and seamless, you can go to:

Settings > Packagizer > Untick Predefined rule: Create Subfolder by Packagename

Settings > Archive Extractor > Set Delete Archive Files after successful extraction? to Delete Files from Harddisk and tick Delete Archive download links after successful extraction?

To make it far easier to start downloading processed JD links, assign a shortcut like Ctrl-D. To set shortcut: Right-click anywhere in the LinkGrabber tab > select Open Menu Manager. Select Start All Downloads item and you will see a way to give it a shortcut.

To turn off advertisements in the application (which may improve privacy and safety), go to Settings > Advanced Settings and locate lines with the following keywords and do the following to their Value fields:

Premium Alert - untick all
Special Deals - untick
Banner - untick
oboom - untick
Donate - set to Hidden (Automode)

GraphicalUserInfaceSettings: Donate Button State

Hidden (Automode)

Tip: JDownloader saves all previously entered archive passwords for future auto-cracking and extracting, via its Password List feature in Settings. So once you build up your password list in JDownloader, downloading from frequent file uploaders becomes extremely painless. To add a list of file passwords you may already have collated elsewhere, go to JDownloader Settings > Archive Extractor, scroll down to Password List and paste them there.

Tip: Use JDownloader's File > Backup function to easily backup and restore your entire settings, passwords list, and even your unfinished download files.

Thank you to Massive for getting rid of the bullshit.

Tip: In JDownloader's interface you can check the IP address being used for a downloading file in real-time. This is useful if you are using a VPN to bypass Tor IP blocking from a download host, and want to check if JDownloader is using the VPN IP. Click on the currently-downloading file (the sub-item), and hover the mouse on the modem icon. A popup will appear which will then load the IP.

Auto-crack and extract files that JDownloader can't

Note: The below unpack script is not observed to be working at at Guide 3.0 launch. It will hopefully be fixed in a subsequent update.

On rare occasions, JDownloader can might at downloading a file from the host, or auto-extracting a downloaded file (e.g. improperly-named .001 files).

For those cases, you can set up the following script to auto-crack and extract a multiple downloaded files archives at once, using your existing JDownloader Password List as the cracking dictionary.

To install:

1. In Terminal do:

sed -i -e "\$aPATH\=\/home\/user\/bin\:\$PATH" .bashrc && source .bashrc && mkdir -p /home/user/bin && cd /home/user/bin && touch unpack && sudo chmod +x unpack && mousepad unpack

and a Mousepad empty text file window will open.

2. Copy the following into the text file, save the file, and close Mousepad and Terminal:

#! /usr/bin/python

import sys, os, re, subprocess, argparse, json
from multiprocessing.pool import ThreadPool, cpu_count
from time import time

class Unpack:
  input_path = '.'
  pass_path = '/home/user/jd2/cfg/org.jdownloader.extensions.extraction.ExtractionExtension.passwordlist.json'
  output_path = './'
  trash_path = './trash/'
  delete = False

  CRED = '\033[91m'
  CGRE = '\033[92m'
  CEND = '\033[0m'

  description = '''\
    Extract password protected archives ending with .rar, .7z, and .zip
    (case insensitive). Handles rar and 7z archives split into multiple
    parts without tweaks. If no input archives are specified, the script
    will try to extract all archives found under the current path while
    ignoring other files. Passwords must be specified in a line separated
    file, with one password per line and no extra whitespace. Overwrites
    files with the same name as those in the archives.'''

  i_help = 'Specify path for input archives (default "' + input_path + '")'
  p_help = 'Specify path for password file (default "' + pass_path + '")'
  o_help = 'Specify path for extracted files (default "' + output_path + '")'
  t_help = 'Specify path for extracted archives (default "' + trash_path + '")'
  r_help = 'Deletes extracted archives after successful extraction (overrides -t)'
 
  archives = {'7z' : set(), 'rar' : set()}
  filtered = {'7z' : set(), 'rar' : set()}
  parts_of = dict()
 
  passwords = set()

  def __init__(self):
    self.parser = argparse.ArgumentParser(prog='unpack', description=self.description)
    self.parser.add_argument('-i', nargs='+', help=self.i_help)
    self.parser.add_argument('-p', nargs=1, help=self.p_help)
    self.parser.add_argument('-o', nargs=1, help=self.o_help)
    self.parser.add_argument('-t', nargs=1, help=self.t_help)
    self.parser.add_argument('-r', action='store_true', help=self.r_help)
    self.args = self.parser.parse_args()
   
    self.delete = self.args.r
   
    self.__build_archive_dicts()
    self.__build_password_set()
    self.__set_output_path()
    self.__set_trash_path()
   
    self.FNULL = open(os.devnull, 'w')
    self.threadpool = ThreadPool(processes=cpu_count())

  def __set_trash_path(self):
    if self.delete and self.args.t:
      print '[Warning] Ignoring -t option (-r option used)'
      return
    if self.args.t:
      self.trash_path = self.args.t[0]
    if os.path.isfile(self.trash_path):
      print "[Error] Is a file: '" + self.trash_path + "' (trash directory)"
      sys.exit()   
     
  def __set_output_path(self):
    if self.args.o:
      self.output_path = self.args.o[0]
    if os.path.isfile(self.output_path):
      print "[Error] Is a file: '" + self.output_path + "' (output directory)"
      sys.exit()
 
  def __build_password_set(self):
    if self.args.p:
      self.pass_path = self.args.p[0]
    try:
      with open(os.path.expanduser(self.pass_path), 'r') as f:
        f_content = f.read()
        try:
          self.passwords = set(json.loads(f_content))
        except:
          self.passwords = set(f_content.strip().split('\n'))
    except Exception as e:
      print e, '(password file)'
      sys.exit()
   
  def __build_archive_dicts(self):
    paths = set(os.listdir(self.input_path) if not self.args.i else list(self.args.i))
    files = set(filter(os.path.isfile, paths))
       
    self.archives['7z']  = set(self.filter(r'(?i)(\.7z|\.zip|\.\d+)$', files))
    self.archives['rar'] = set(self.filter(r'(?i)\.rar$', files))
   
    self.filtered['7z']  = set(self.filter(r'(?i)(\.7z|\.zip|\.0*1)$', self.archives['7z']))
    self.filtered['rar'] = set(self.filter_not(r'(?i)part(?!0*1\.)\d+\.rar$', self.archives['rar']))
   
    self.__build_parts_of_dict('7z',  r'\.\d+$', r'\.\d+')
    self.__build_parts_of_dict('rar', r'(?i)\.part\d+(?=\.rar$)', r'\.[Pp][Aa][Rr][Tt]\d+')
   
    for path in files - (self.archives['7z'] | self.archives['rar']):
      print '[Warning] Not an archive:', path, '(wrong extension)'
       
  def __build_parts_of_dict(self, extension, pattern, repl):
    for archive in self.filtered[extension]:
      regex = r'^' + re.escape(re.sub(pattern, '//', archive)).replace('\/\/', repl) + r'$'
      parts = sorted(self.filter(regex, self.archives[extension]))
      self.parts_of[archive] = filter(lambda p: len(p) == len(archive), parts)
   
  def __find_password(self, archive):
    start = time()
    args = ['unrar', 't', '-o+'] if archive in self.archives['rar'] else ['7z', 't', '-aoa']
    for password in self.passwords:
        rc = subprocess.call(args + ['-p'+password, '--', archive], stdout=self.FNULL, stderr=self.FNULL)
        if rc == 0:
          return archive, password
    return archive, None
   
  def __unpack(self, archive, password):
    args = ['7z', 'x', '-aoa', '-p'+password, '-o'+self.output_path, '--', archive]
    if archive in self.archives['rar']:
        args = ['unrar', 'x', '-o+', '-p'+password, '--', archive, self.output_path]
    rc = subprocess.call(args, stdout=self.FNULL, stderr=self.FNULL)
    return rc
   
  def __make_dir(self, directory):
    if not os.path.exists(os.path.dirname(directory)):
      try:
        os.makedirs(os.path.dirname(directory))
      except OSError as e:
        if e.errno != errno.EEXIST:
          raise
   
  def __trash(self, targets):
    if self.delete:
      return subprocess.call(['rm'] + targets)
    else:
      self.__make_dir(self.trash_path)
      return subprocess.call(['mv'] + targets + [self.trash_path])
   
  def unpack(self):
    for archive, password in self.threadpool.imap_unordered(self.__find_password, self.parts_of):
      if password != None:
        print '[Extracting] ' + archive,
        rc = self.__unpack(archive, password)
        if rc == 0:
          print self.CGRE + 'SUCCEEDED' + self.CEND
          rc = self.__trash(self.parts_of[archive])
        else:
          print self.CRED + 'FAILED' + self.CEND
      else:
        print '[Warning] No password for: ' + archive + self.CRED + ' FAILED' + self.CEND
    print '[Done]'
           
  def filter(self, regex, sequence):
    return filter(lambda x: re.findall(regex, x), sequence)
   
  def filter_not(self, regex, sequence):
    return filter(lambda x: not re.findall(regex, x), sequence)

start = time()
unpack = Unpack()
unpack.unpack()
print time()-start

To use:

Go to the folder with your downloaded files in Thunar File Manager, and either right-click or go to File and then Open Terminal Here which opens a Terminal window with the working folder as the current one in Thunar.

In that Terminal do: unpack and it will automatically crack and extract all archives in that directory, assuming you have all correct passwords listed in your JDownloader Password List.

Note: unpack can take a long time, but it should work. If you have an incredibly long password list, it may take too long to be practical. Other password-cracking software may be superior.

Thank you to Massive for getting rid of the bullshit.

Alternative to JDownloader for downloading videos (with more custom options)

For YouTube videos, JDownloader is the easiest way to automatically download a combined video and audio file containing the highest quality video stream (e.g. 1080p with 128 kbit audio). But if you want more manual control, use youtube-dl (a command-line program). Like JDownloader, youtube-dl supports hundreds of video sites including YouTube.

To use:

Note: You may have to use a VPN inside Whonix for youtube-dl to work. YouTube seems to not like some Tor IP addresses.

1. Find the URL of the video you want to download, and do in Terminal after this example: youtube-dl --list-formats https://www.youtube.com/watch?v=ESD3mlgpSwM

2. youtube-dl will print a list that shows all of the raw formats/streams available on YouTube's server for that video URL (some streams may be "video only" or "audio only", and others are combined). Choose the stream you want to download (and note that for 1080p streams you have to extract the 1080p video only stream and an audio stream separately, then combine them in a tool like HandBrake afterwards), and note its number in the format column on the left.

3. In this example I'll download the 720p combined video and audio stream which is numbered 22, so I'll do: youtube-dl -f 22 https://www.youtube.com/watch?v=ESD3mlgpSwM

4. It downloads the file into the folder that Terminal is currently working in, which is by default the user folder (/home/user), above Downloads.

«

»

Create and Extract Password-Protected Archives like 7-Zip / RAR

Right-click on an archive in Thunar File Manager and select Open With "Archive Manager". Archive Manager will open and prompt you for the password. You can then use the Extract button or open the files directly from inside the archive.

After the first time setting Archive Manager as the default app for a given archive format, simply double-click on that format from then on.

Alternatively, right-click on the archive in Thunar and use the Extract Here or Extract To... menu items.

To create archives, simply right-click on any selection of files and/or folders in Thunar File Manager and select Create Archive... If given the choice of what archive program to use, select Archive Manager. It then gives options for format choice, password setting, encrypting the file names, file splitting, and so on.

Note: Right now there appears to be a long delay when creating archives above a certain size using this method. Please discuss in an official support thread and perhaps we can find a reliable fix.

«

»

Image Viewing

Use XnView Multi Platform.

To install:

1. Download the 64-bit .deb installer file from their download page.

2. Open the file with GDebi Package Installer and click on Install Package, using password changeme when asked, then finally clicking Close.

Its interface is very customizable and features include fullscreen, slideshow, folder view with thumbnails, convenient image pixel dimensions checking, basic image editing, and more.

To customize:

These settings are a suggestion for turning XnView MP into an excellent everyday image viewer. The options are powerful enough for you to choose exactly how you want it to behave.

Under Tools > Settings...

General > General tab > Startup pane > Mode when starting with a file to Fullscreen - Viewer

Interface > Shortcuts tab > change Browser mode dropdown box to Viewer mode and then set:
- 100% to R
- Fit image to window to F
- Fit image to window height to H
- Fit image to window width to W
- Zoom in and Zoom out to Ctrl-= and Ctrl--

Interface > Keyboard tab > Pressing ESC once quits XNViewMP to Always

Interface > Mouse tab > Left button to Move picture and Mouse wheel to Scroll up/down

Interface > Switching mode tab > set both Use double click ... and Use ENTER ... to Browser > Fullscreen > Viewer

View > Fullscreen > set Auto image size to Fit image to window, large only, then untick Show playbar, Show info, and Floating views

To apply the changes, restart XNViewMP by closing off all windows.

To use:

With the recommended settings above, images will open in full screen by default. Press Enter or double-click on an image to toggle between fullscreen, full-window, and folder thumbnail views. To instantly close off an image, simply press Esc.

With the keyboard shortcut customizations suggested above, you can zoom in and out, fit image to screen, fit to screen width/height, or zoom to 100% size very easily.

For an instant zoom and pan, single-click and hold the mouse in fullscreen or full-window mode, and drag around to pan.

For slideshow, you can set a keyboard shortcut to activate / stop slideshow. Go to Tools > Settings... > Interface > Shortcuts tab > change Browser mode dropdown box to Viewer mode then set Quick Slideshow to a key like F5.

To customize the slideshow settings (like seconds per image or how to cycle images), go to Tools > Settings... > View > Misc. tab and customize underneath Quick slideshow.

«

»

Video Playback

Use VLC. It comes pre-installed.

Tip: If you want to watch more than one video at a time, go to Tools > Preferences and untick Only use one instance when started from file manager.

«

»

Show Media File Thumbnails in Thunar File Manager

1. In Terminal do: sudo apt install tumbler tumbler-plugins-extra libtumbler-1-dev ffmpegthumbs ffmpegthumbnailer ffmpegthumbnailer-dbg libffmpegthumbnailer4v5 libffmpegthumbnailer-dev ooo-thumbnailer && thunar -q

2. Now open Thunar. Go to Edit > Preferences > Display > Set Show Thumbnails to Always and click Close.

3. Refresh Thunar again and now thumbnails will now appear.

«

»

Inspect Media Files

Want to easily check the resolution or video/audio codec of a video file, or the pixel dimensions of an image? Use MediaInfo.

To install:

In Terminal do: sudo apt install mediainfo-gui then it's ready to use.

To use:

Either open MediaInfo from the Whisker Menu then open the media file you want to inspect, or right-click the file in Thunar and select Open With > Open With "MediaInfo".

Tip: To see the full media info for your file, switch from the default Easy view by going to View > Text or HTML.

«

»

Duplicate File, Image or Video Finder

Files

Use FSlint.

To install:

In Terminal do: sudo apt install fslint

Images

Use Geeqie.

To install:

In Terminal do: sudo apt install geeqie

To use:

In Geeqie go to File > Find duplicates...

Choose your desired Compare by: method.

Drag and drop and folder from Thunar File Manager with the pictures you want to find dupes in. To include all subfolders inside the folder you drag, select Add contents recursive.

Videos

Use Video Duplicate Finder.

To install:

1. In Terminal do: sudo apt install ffmpeg libgdiplus

2. Go to Video Duplicate Finder's Github and download the latest Linux release such as this one . Extract the tarball.

To use:

In the extracted binary folder, find the file VideoDuplicateFinderLinux and open it. Program is self-explanatory.

«

»

Screenshot Tool

Use Screenshot. It comes pre-installed.

To use:

Simply open Screenshot from the Whisker Menu or try your PrintScreen key to invoke the program.

Tip: To manually assign your PrintScreen key or any other hotkey to activate the tool, open Keyboard from the Whisker Menu, go to the Application Shortcuts tab Add a new entry with command xfce4-screenshooter and click OK, and press the hotkey you'd like such as PrintScreen or Alt-P.

«

»

Basic Image Editing

Use Pinta.

To install:

1. Download the latest 64-bit .deb installer file from the Sid repository.

2. Open the file with GDebi Package Installer and click on Install Package, using password changeme when asked, then finally clicking Close, then it's ready to use.

Functions include Draw / Paint, Crop, Rotate, Mirror, Flip, Resize / Shrink. It feels halfway between Microsoft Paint and Adobe Photoshop.

«

»

Serious Image Editing

Use GIMP (GNU Image Manipulation Program).

To install: In Terminal do: sudo apt install gimp

«

»

Batch Convert Images (Excluding Animated GIFs)

Use XnConvert.

To install:

1. Download the 64-bit .deb installer file from their download page.

2. Open the file with GDebi Package Installer and click on Install Package, using password changeme when asked, then finally clicking Close.

To use:

Open XnConvert from the Whisker Menu and add the images you want to convert in the first Input window. Then you can add Actions in the next tab (e.g. pixel size via Resize, Rotate and much more), and then in Output tab you can set things like JPEG quality (to lower file size) under Format > Settings... before finally clicking Convert to do the bulk action.

«

»

Image Folder Thumbnail / Contact Sheet Creator

Use XnView Multi Platform.

To install:

1. Download the 64-bit .deb installer file from their download page.

2. Open the file with GDebi Package Installer and click on Install Package, using password changeme when asked, then finally clicking Close.

To use:

Open XnView Multi Platform from the Whisker Menu and navigate to your image folder inside the program. Select all images you want to make a contact sheet from, then in the menu go to Create > Contact sheet... and customize to make it look as nice as you want.

«

»

Screen Recording Tool

Use vokoscreen.

To install:

In Terminal do: sudo apt install vokoscreen then it's ready to use.

It's a very nice GUI app. It can export to a quality MKV, MP4, or GIF file. Options and functionalities include recording audio at same time as video, AKA 'capping'.

Tip: For serious capping (e.g. to record a Skype chat while inside Whonix), try OBS Studio or for other alternatives, take a look here.

«

»

Basic Video Editing

Use HandBrake.

Functions include rotate, crop, trim, change formats, shrink video size (e.g. convert to H.265 / HEVC format), and export video frames to images.

To install:

In Terminal do: sudo apt install handbrake then it's ready to use.

Note: After installing, HandBrake can hijack your default file association for some video file extensions. To reset those associations, open MIME Type Editor from the Whisker Menu, sort by Default Application column and scroll down to the list of HandBrake items and for each item single-click on HandBrake to pull up a menu to select your preferred media player instead.

«

»

Join or Merge Multiple Videos into One File (e.g. Compilation)

The easiest way (to convert files of any video format into one single H.264 file) is actually a command line method.

To install:

In Terminal do: sudo apt install ffmpeg melt

To use:

Do after this example:

melt one.avi two.mov three.mpeg four.mp4 five.wmv six.mkv seven.ram eight.webm -consumer avformat:output.mp4 acodec=libmp3lame vcodec=libx264

If anyone knows a more beginner-friendly GUI method for merging videos, please share in an official support thread.

«

»

Add Subtitles or Audio Tracks to Video Without Reencoding

Use MKVToolNix, which will enable you to combine files like MP4, SRT and audio with no quality loss due to no reencoding of the video like if you use HandBrake.

To install:

1. First go to this page and do their wget -q -O command that's instructed near the top, then come back here.

2. Now do: sudo add-apt-repository 'deb https://mkvtoolnix.download/debian/ buster main'

3. Then do: sudo apt update && sudo apt install mkvtoolnix mkvtoolnix-gui then it's ready to use. Find it as MKVToolNix GUI in the Whisker Menu.

To use:

Drag or add your video / audio / subtitle files into Input files: window, make any desired adjustments, then click Start muxing and a clean single MKV file will be generated for you.

«

»

Serious Video Editing

Use Kdenlive.

Uses include adding pixelation or censors to cover faces.

To install:

In Terminal do: sudo apt install kdenlive

«

»

Create Animated GIF from Video

To install:

In Terminal do: sudo apt install handbrake ffmpeg

To use:

1. Open the original video in HandBrake and in the default Source tab, click on Chapters: button to select Seconds: and specify the start and finish time in seconds to represent the animated GIF selection, then export to your trimmed video file ready for converting to GIF.

2. In the folder with your trimmed video selection, do after this example in Terminal: ffmpeg -i trim.m4v result.gif -hide_banner

If someone discovers a good GUI method to convert video to animated GIF (which is better than Gifcurry which was checked on 2019-09-30 and was deemed not good enough), please share.

«

»

Shrink Animated GIFs

Use gifsicle (a command-line program).

To install:

1. Download the latest 64-bit .deb installer file from the Sid repository.

2. Open the file with GDebi Package Installer and click on Install Package, using password changeme when asked, then finally clicking Close, then it's ready to use.

To use:

Do after this example: gifsicle -O3 original.gif -o optimized.gif (which sets the optimization algorithms on strongest setting) or gifsicle --scale 0.5x0.5 original.gif -o resized.gif (to resize pixels to half size).

Tip: Reducing size of animated GIFs is quite an art. See this guide for the various ways you can do it. This single-step command can only go so far.

«

»

Create 3D Art

Use Blender.

To install:

1. Download the 64-bit Linux installer file from its website

2. Unpack the tarball and run the application from inside the extracted folder.

«

»

Video Thumbnail / Contact Sheet Creator

Use SMPlayer.

To install:

In Terminal do: sudo apt install smplayer mplayer

To use:

Open SMPlayer from the Whisker Menu and go to Video > Thumbnail Generator....

Note: Depending on your hardware, to get this working you may need to go to Options > Preferences > General and set Multimedia engine: to mplayer (/usr/bin/mplayer), and also possibly in the Video tab, change Output driver: to x11 (slow).

Tip: To do bulk video file thumbnail creation, try Video Contact Sheet *NIX (vcs). Install via either their provided repo or this DEB. For help and usage examples, see their website or ask in a site's Tech forum.

«

»

Image, Video and Document Metadata Stripping Tool

Use mat2 (a command-line program). This can remove metadata from files like image, video, DOCX, and PDF.

To install:

1. Download the latest 64-bit .deb installer file from the Sid repository.

2. Open the file with GDebi Package Installer and click on Install Package, using password changeme when asked, then finally clicking Close, then it's ready to use.

To use:

In Terminal do after this example: mat2 dirty.mp4. It will create a 'cleaned' duplicate of the file ready to use. To verify the dirtiness of any file, do after this example: mat2 -s file.pdf

Note: To further clean and sanitize PDFs, also try qpdf, pdfparanoia, and pdf-redact-tools. But be advised that the PDF format is complicated and provides a minefield of murky ways that someone can insert data to somehow watermark or deanonymize you. If your situation is serious, keep all documents that you share in plain text (TXT) format only.

Tip: To clean an entire folder of files at once (including its subfolders), open Terminal in the folder (right-click in Thunar then Open Terminal Here) and do: mat2 * Then, to remove all dirty files at once, do: find -type f -not -name '*cleaned*' -not -name '*.gif' -delete

«

»

File and Image Uploader

Want to upload multiple large files (to dl.free.fr) or hundreds of images (to directupload.net) all at once, saving you time and effort as an uploader?

Use FIU (File & Image Uploader).

To install:

1. In Terminal do: sudo dpkg --add-architecture i386 && sudo apt update && sudo apt install wine wine32 playonlinux

2. Download FIU's program EXE file (FileUploader.exe) from the official download page.

3. Open PlayOnLinux from the Whisker Menu. In its main window, click on Install a program > Install a non-listed program, click Next four times, and enter a name in the virtual drive text box like FIU, then click Next three more times. Click on the Browse button and point to your downloaded FileUploader.exe, click Next and go through FIU's first-run popups, then close FIU.

4. The next window is for making a Desktop shortcut for FIU in your Whonix. First, in Thunar File Manager move FileUploader.exe and FileUploader.nast into ~/.PlayOnLinux/wineprefix/FIU/drive_c/Program Files/. Then, in the PlayonLinux Wizard window, select Browse from the list and click Next > Browse and open the FileUploader.exe that you just moved to the virtual Program Files folder location. Then click Next twice. Then select I don't want to make another shortcut, click Next, close off PlayOnLinux, then it's ready to use.

Tip: When uploading, make sure to untick use account in the Add file(-s) dialog, or the upload may not work.

Tip: Simply click on a finished download in the queue list or press Ctrl-C while selected and its URL is instantly copied to the clipboard. Select multiple ones and do Ctrl-C to copy the list of all download URL at once.

Tip: If you use FIU a lot, be aware that it updates quite regularly similar to JDownloader's own auto-updates which add support for new hosts or apply fixes for handling them. With FIU you have to manually perform the update and you can do it from within the app at Help > Update. It will either allow you to update to a new version if available, or indicate that it's already the latest by saying This is up-to-date version .... You can check when the last update was issued by going to z-o-o-m.eu and compare it with your current version by going to Help > History and seeing the version number at the top of that changelog.

Tip: For more privacy and anonymity, go to Tools > Settings > Misc > Privacy, untick both checkboxes and click OK.

Note: when you minimize FIU it minimizes to the system tray instead of the taskbar. Click on its logo icon to restore the window again. To turn this behavior off permanently, go to Tools and untick Show tray icon.

«

»

Backup Files to the Cloud (e.g. MEGA)

After finally putting your files inside your secure hidden VeraCrypt volume, you might want to back them up to the cloud as a way to not lose them in case of data loss.

MEGA is a great service to use, because they have 50 GB free online storage, a seamless Linux GUI file sync / upload program, and a very strong general attitude of 'fuck you' to LEA. They also claim to use 'advanced end-to-end encryption' whereby only your account password or a locally generated download URL for a file on your account (which is unknown to MEGA by default) can possibly decrypt it on the server. This may make these files very reliable if you never share the link online, but it's probably a good idea to upload your files in a hidden VeraCrypt volume file.

To install:

1. Download the latest Debian 10.0 64-bit .deb file from its website such as this one.

2. Open the file with GDebi Package Installer and click on Install Package, using password changeme when asked, then finally clicking Close.

3. Open MEGASync from the Whisker Menu, and follow its wizard to create a free account using an anonymous email address, following the steps to verify the email address, and activate. If activation doesn't work, try creating an email (e.g. at guerrillamail.com) in Opera with its non-Tor IP address, and also registering the MEGA account at mega.nz instead of via the app, then log into the app with the account.

To use:

Program is self-explanatory. As the default, simply put your file(s) in ~/MEGAsync/ and it will upload to the account.

There is now an official File Manager Integration package as another way of adding files to your Mega account via Thunar.

«

»

Search and Find Files Anywhere Inside Whonix

Use Recoll.

To install:

1. First go to this page and do their gpg --keyserver and gpg --export commands instructed near the top, then come back here.

2. Now do: echo -e "deb http://www.lesbonscomptes.com/recoll/debian/ buster main\ndeb-src http://www.lesbonscomptes.com/recoll/debian/ buster main" | sudo tee /etc/apt/sources.list.d/recoll.list

3. Then, do: sudo apt update && sudo apt install recoll python-recoll python3-recoll python-lzma python-rarfile antiword libimage-info-perl python3-mutagen python-mutagen python-mutagen-doc python-chm unrtf untex xsltproc poppler-utils wv libwv-dev then it's ready to use.

Open Recoll from the Whisker Menu and initialize its indexing of your Whonix file system, following the wizard guide to your preferences. To use the true power of Recoll in being able to exhaustively search all system or program config files in your entire Whonix (which is great for problem solving for intermediate users learning how to do things in Linux), in Indexing configuration > Top Directories remove ~ and add / (i.e. a single forward slash), under Skipped paths remove media, then in Local parameters tab remove any useful file extensions you want to search from the Ignored endings list, as well as items from Skipped names (like tmp).

Suggested settings:

Go to Preferences > GUI Configuration > Result List tab and set Number of entries in a result page to 100 and change Result list font text size to size 8. Then, turn on real-time auto-indexing of your entire Whonix file system (and to run in the background at startup) via Preferences > Indexing schedule.

Note: To be able to open parent folders of search results in Thunar or a few other file types like PDF, the default setting doesn't work in Recoll. To fix, go to Preferences > GUI configuration > User Interface > Choose editor applications and click on the top Command column title twice to sort it. Look at the items which are not set to Desktop Default. For items incompatible with Xfce such as ones containing dolphin (for opening folders) or evince (for opening PDFs), simply double-click on them in the Command column and then Apply to current selection to reset to Xfce's default choice, or change the commands to Xfce equivalents like thunar

Tip: To filter by a file extension, do ext:mp4 (e.g. do ext:mp4 cum to find any MP4 videos with 'cum' in the title or in its metadata), do filename:fuck to filter to only files with fuck just in the file name (and not elsewhere like folder name), do dir:/this/folder (recursive) or -dir:/that/folder to restrict or exclude specific folders or parent folders from the results. Find more tips by going to Help > User manual.

Tip: If Recoll doesn't work well for you, try Searchmonkey (sudo apt install searchmonkey). It needs to do a manual search of your specified parent directory every time, but it works very reliably.

«

»

Checksum / Hash Tool

Use Quickhash GUI.

To install:

1. Download the Linux installer ZIP from the official download page.

2. Unpack the ZIP and open the file with GDebi Package Installer and click on Install Package, using password changeme when asked, then finally clicking Close.

«

»

Clipboard History

Use ClipIt.

To install:

1. Go to ClipIt's Github release page and download the latest .deb file of version 1.4.5 or later.

2. Open the file with GDebi Package Installer and click on Install Package, using password changeme when asked, then finally clicking Close.

To use:

Open ClipIt from the Whisker Menu and configure it as you like. ClipIt adds itself to startup applications automatically.

«

»

Text File Creating and Editing

Use Mousepad. It comes pre-installed.

To create a text file, right-click on the desktop or in a folder and select Create Document > Empty File.

«

»

Word Processor

Use LibreOffice. It's the cross-platform Linux-compatible equivalent to Microsoft Word. It can open, edit, and convert to and from DOC, DOCX, RTF, and more, including converting them to plain text or PDF.

To install:

In Terminal do: sudo apt install libreoffice

«

»

PDF Viewing

Use Foxit Reader.

To install:

Download the Linux (64-bit) installer tarball from the Foxit website, extract the archive in Thunar File Manager, then open the extracted RUN file and follow the GUI installation wizard.

Tip: To edit PDFs in Whonix, try LibreOffice Draw.

«

»

Email Client

Use Thunderbird.

To install:

In Terminal do: sudo apt install thunderbird

Compatible with any POP or IMAP email and you can install PGP encryption add-ons such as Enigmail.

«

»

Further Tips, Tweaks, and How-To's

Uninstall a Program

For any program that you've installed by doing sudo apt in Terminal, or with a DEB file using GDebi Package Installer, in Terminal do: sudo apt remove <packagename>. But be careful. Read carefully what you're about to remove before you press y. Sometimes it can ask to remove dependencies which are needed by other packages. Choose to keep dependencies if you think they might be needed by other apps or if you are not sure.

Warning: Sometimes APT can mistakenly think that a huge list of packages are no longer needed. This is a bug. As you can see in the below screenshot, it is telling you that you can remove packages including xfce4 which will actually remove Xfce from your Whonix and reduce it to command-line mode only.

NEVER perform sudo apt autoremove unless: 1. you're an advanced user and know what dependencies you're removing, and 2. you do a backup first.

«

»

Make Tor Browser / Firefox Scrolling Less Laggy

Depending on your hardware, Firefox can have an annoying mouse scrolling slowness and lag issue, and you can fix it. Go to Tor Browser Preferences and search scroll to find Use smooth scrolling and untick it. You can also experiment by searching for Performance and unticking Use recommended performance settings followed by unticking Use hardware acceleration when available.

«

»

Make the Taskbar Better

Open Panel from the Whisker Menu, then navigate to the Items tab. Double-click on the Window Buttons item, and customize as you like such as Sorting order: to None, allow drag-and-drop which makes taskbar act more like Windows with ability to re-sort taskbar items manually with the mouse. Untick Show handle to clean it up.

You can also add a lot of familiar controls and functions to Xfce's taskbar. In Panel > Items tab, simply click on the green plus button and you can add items such as in the screenshot above.

Lastly, you can remove default pinned taskbar items by right-clicking on them and selecting Remove and confirming to remove those Launcher items.

«

»

Set a Keyboard Shortcut for 'Show Desktop' (Minimize All)

Open Window Manager from the Whisker Menu and in the Keyboard tab, find the Action near the bottom called Show Desktop. Select it and click on Edit where you can set it to what you'd like, such as Win-D.

«

»

Set a Keyboard Shortcut for 'Shut Down'

VirtualBox itself offers the best solution to do this. It's Customizable via VirtualBox's Preferences > Input > Virtual Machine > ACPI Shutdown item, it's your chosen VirtualBox 'host' key + another key combination of your choice.

To speed up this method of Whonix shutdown, in Whonix open Power Manager from the Whisker Menu and set When power button is pressed: to Shutdown.

«

»

Set a Keyboard Shortcut to Toggle Thunar, Terminal, or Any Other App in Whonix

If you are a Whonix power user, this AutoKey script can make your app switching experience much faster and easier.

1. In Terminal do: sudo apt install autokey-common autokey-gtk then it's ready to use.

2. Open AutoKey from the Whisker Menu.

3. Click on Sample Scripts in the left-hand pane, then New > Script and name it whatever you like.

4. In the new script widow, delete #Enter script code and enter the following code for the example of toggling Thunar:
```
#AutoKey script to toggle any app like Thunar.
import subprocess
command = 'wmctrl -lx'
output = system.exec_command(command, getOutput=True)

if 'Thunar.Thunar' in output:
    winClass = window.get_active_class()
    if winClass == 'Thunar.Thunar':
        system.exec_command("xdotool windowminimize $(xdotool getactivewindow)")
    else:
        system.exec_command("wmctrl -x -a Thunar.Thunar")

else:
    system.exec_command("thunar")
#end script
```
5. Now assign it the hotkey you'd like (e.g. Win-E) by clicking on Set (to the right of Hotkey:) > Press to set, performing the hotkey, then clicking OK.

6. Now save the script to make it live by clicking Save up the top, and close off AutoKey.

7. To make your hotkey(s) turn on at every Whonix startup, AutoKey must be added to Autostart. Open Session and Startup from the Whisker Menu, go to Application Autostart tab, Add a new entry and input autokey in all three text boxes then click OK.

To make a toggle for Terminal (e.g. Win-T), in the script code simply substitute Thunar.Thunar with xfce4-terminal.Xfce4-terminal, and the lowercase thunar with xfce4-terminal. For JDownloader (e.g. Win-J), the Window class is sun-awt-X11-XFramePeer.JDownloader.

«

»

Set Keyboard Shortcuts to 'Snap' Windows to the Right / Left / Four Corners

Open Window Manager from the Whisker Menu then go to Keyboard tab and find the series of Action items called Tile window to the... and double-click on each item to set your desired hotkey for it such as Win-⬅ for to the Left.

«

»

Enable Ctrl-Tab Everywhere

To make Ctrl-Tab and Ctrl-Shift-Tab do tab switching in Thunar or other Xfce windows as you might be used to, you can achieve this using AutoKey.

1. Download and set up AutoKey as instructed in the earlier toggle Thunar mini-guide.

2. Create two new scripts as follows, setting one to Ctrl-Tab and the other to Ctrl-Shift-Tab:

if window.get_active_class() == 'Navigator.Tor Browser':
    keyboard.send_keys("<ctrl>+<tab>")

elif window.get_active_class() == 'Navigator.Firefox-esr':
    keyboard.send_keys("<ctrl>+<tab>")

elif window.get_active_class() == 'Opera.Opera':
    keyboard.send_keys("<ctrl>+<tab>")

elif window.get_active_class() == 'chromium.Chromium':
    keyboard.send_keys("<ctrl>+<tab>")

elif window.get_active_class() == 'sun-awt-X11-XFramePeer.JDownloader':
    keyboard.send_keys("<ctrl>+<tab>")

else:
    keyboard.send_keys("<ctrl>+<alt>+<page_down>")

if window.get_active_class() == 'Navigator.Tor Browser':
    keyboard.send_keys("<ctrl>+<shift>+<tab>")

elif window.get_active_class() == 'Navigator.Firefox-esr':
    keyboard.send_keys("<ctrl>+<shift>+<tab>")

elif window.get_active_class() == 'Opera.Opera':
    keyboard.send_keys("<ctrl>+<shift>+<tab>")

elif window.get_active_class() == 'chromium.Chromium':
    keyboard.send_keys("<ctrl>+<shift>+<tab>")

elif window.get_active_class() == 'sun-awt-X11-XFramePeer.JDownloader':
    keyboard.send_keys("<ctrl>+<shift>+<tab>")

else:
    keyboard.send_keys("<ctrl>+<alt>+<page_up>")

This example provides exclusions for Tor Browser, Firefox ESR, Opera and JDownloader. They are different to the Xfce windows that otherwise need this script. For any other programs which conflict, simply determine their Window class using AutoKey's Window Filter feature and add them as additional elif entries in the script.

«

»

Insert Special Characters and Symbols in Whonix (Like Windows Charmap)

To install:

In Terminal do: sudo apt install kcharselect then it's ready to use.

To use:

Open KCharSelect from the Whisker Menu. GUI is self-explanatory. To easily find a symbol (e.g. ™ or © r ℗), just search its keyword like trade mark or copyright.

«

»

Further Privacy, Security, Anonymity, Social, and File Sharing Tools

I Want My Skype

To install Skype in Whonix:

1. Download the latest 64-bit Skype .deb file from its website or click on its direct link here.

2. Open the file with GDebi Package Installer and click on Install Package, using password changeme when asked, then finally clicking Close.

Sign up for a new account using an anonymous email, and if Skype appears to be blocking Whonix's Tor IP, use the VPN trick like Opera or the other VPN method combined with Firefox ESR.

Mic or webcam functionality has not been tested for this guide. There is probably fake webcam driver software for Linux available that inputs fake video (and/or audio) of your choice, to do the job. If someone works it out, please share in an official support thread.

Tip: To uninstall Skype, in Terminal do: sudo apt remove skypeforlinux

«

»

I Want My BitTorrent

So you want to download some sort of boy movie on torrents like from blizzardkid.net? Use Transmission.

To install:

In Terminal do: sudo apt install transmission then it's ready to use.

Tip: For extra anonymity, go to Transmission > Edit> Preferences> Network and tick Pick a random port every time Transmission is started.

Tip: To have more success torrenting in Whonix, use a non-Tor IP (for both browsing torrent sites and then directly downloading in Transmission). The easiest way is to use a free VPN as instructed earlier. To verify that Transmission is using the non-tor IP address, use TorGuard's Check my Torrent IP service. Download the magnet link and the error message in Transmission will show your IP, which should be the one your VPN specifies (such as one from VPNGate).

Tip: Another option for torrenting inside Whonix may be to use a free online distributed seedbox service like bitport.io, zbigz.com, seedr.cc, transfercloud.io or filestream.me which you can sign up to with an anonymous email. Their seedboxes have have fully opened working ports and are much better placed in the Internet infrastructure for fast torrent downloading. Add a magnet link or .torrent URL on the free account, then when finished you can directly download the torrented file(s) over simple HTTP in your browser (or possibly JDownloader).

«

»

I Want My PGP

PGP is built-in and very easy to use. Open gpa (Gnu Privacy Assistant) from the Whisker Menu. This is your one-stop program to create, view, import and export PGP keys and more. Via Windows > clipboard you have the interface to create PGP blobs from plain-text, decrypt blobs people send you, encrypt and decrypt files, and everything else that PGP can typically do.

Warning: Do not use the same password or style of password for GPG keys in your Whonix as the password you use to unlock your hidden VeraCrypt volume to access your Whonix in the first place. Malware in Whonix - e.g. JavaScript code on an LEA-seized site - could spy on your keystrokes inside Whonix. Don't let them discover your VeraCrypt volume password in this way.

Note: For non-key pair (symmetrical) encryption of any file or data, please use VeraCrypt (and not PGP) which is the safest option for very sensitive data.

«

»

I Want My Freenet

Freenet is known to host Files. It's a useful but aging technology for privacy, secrecy, and anti-censorship on the Internet.

To install:

Follow Freenet's Linux installation instructions here. If connection doesn't work, try referring to these instructions on the Whonix Wiki.

To use:

Always browse Freenet with an alternative browser in Whonix like Firefox ESR. After Freenet is installed, type about:config into Firefox ESR URL bar, press Enter , search for network.proxy.no_proxies_on and set it to 0. Then go to http://127.0.0.1:8888/ to start using Freenet, and be patient (maybe several hours) to let it find peers and start connecting to that particular network. If you have trouble maybe ask on the Whonix forums. If you have success, please share in an official support thread.

Tip: To uninstall Freenet, first run Shutdown Freenet from the Whisker Menu then in Terminal do: java -jar ~/Freenet/Uninstaller/uninstaller.jar

«

»

I Want My I2P

Try the Whonix wiki's I2P instructions and report any success in an official support thread. Alternatively, in Whonix's Tor Browser you can browse I2P using one of these suggested I2P web 'Inproxies'.

Warning: People running I2P web proxies can view everything you do through them. Only use them for basic eepsite browsing / downloading, and expect all login credentials you enter to be stolen or harvested by the proxy operators if they so choose to.

«

»

I Want My IRC

IRC is built-in and easy to use. Open HexChat from the Whisker Menu. Alternatively, use a web client in Tor Browser.

Warning: Live chat is a very easy way for your personality and writing style to be leaked, as you have no time to think about how you're writing and expressing yourself to others. You could be speaking to a law enforcement officer at any time, so please be aware of this potentially significant risk.

«

»

I Want My Usenet

Want to find material on Usenet to share on Tor? Use SABnzbd.

To install:

In Terminal do: sudo apt install sabnzbdplus

To use:

Open SABnzbd+ from the Whisker Menu but click No in the URL prompt for Tor Browser and instead open Firefox ESR from the Whisker Menu, navigate to http://localhost:8080/sabnzbd/ and follow the wizard guide to set up the client to start downloading your binaries.

You will need to find a free Usenet provider that doesn't block Tor IPs (or you can find a VPN IP address like with our VPNGate method instructed earlier. You also may find it hard to find a free provider with long file retention, but there will be some that satisfy all requirements if you search online.

«

»

Various FAQs

Do I Always Need to Turn on Gateway Before Workstation?

No. Gateway just gives Workstation its Internet. You can use Workstation offline like any other VM and just reboot Gateway or Gateway's Tor process to use Internet in Workstation again.

«

»

I'm Scared of Linux. Will I Run into Problems or Even Lose My files Because of It?

No. Don't be afraid of Linux! It is actually more stable and less buggy than Windows these days. Most of what you do in Whonix is not Terminal commands but all GUI, and it's easy to get used to the Terminal if you have a little patience. Be brave to click around in Whonix and try using it like you would Windows. Download a practice Whonix before moving over your files.

Ask questions in an official support thread if you need help. The Terminal in Whonix is the only 'scary' thing that you may not be used to. If you have used Command Prompt in Windows, or Terminal on the Mac, it's very similar to that.

«

»

Am I Missing out on Better Windows / Mac Software by Moving to Whonix?

Yes, but it's nowhere near as bad as you think. It can't be avoided that the interface and software quality of Whonix is not as good as the polished, commercial, billion-dollar ecosystems of Microsoft, Apple and Google. Linux is community-powered and built "by the people, for the people". It will surprise you what cool software and features a bunch of passionate, obsessive, and stubborn computer nerds and freedom fighters can produce. Welcome to Linux!

Note: With PlayOnLinux, an emulator for Windows apps in Linux, it may be possible to run apps like Windows Photoshop inside Whonix. A better option now would be to create a Windows VM on HiddenVM and run it alongside your Whonix, carefully disabling its network access in VirtualBox.

«

»

Do I Have to Worry About App Updates? How Does That Work in Linux?

In Debian, it's very elegant. By default, Whonix's 'app store' is something called the Debian 'Stable' repository. All programs installed via sudo apt install as well as the default included programs are automatically updated each time you do sudo apt update && sudo apt full-upgrade. Some of the versions issued by the 'Stable' repo are sometimes very old, but the benefit is that whenever updates do come, they are automatic.

To use newer versions and still get automatic updates, you can use the 'backports' feature. It is quite a stable way of getting slightly newer versions.

But for more cutting edge versions of packages, you can try directly downloading DEB files from either the Debian 'testing' repo, or the developer's website directly. Sometimes it can't work because it is too new for Whonix's Debian version, but when it does, you may prefer it for some apps you work with very often. However you need to check for updates completely manually with this method.

Lastly, the best option for automatically being updated to the very latest version of a package is to add its third-party repository to your APT sources. Some examples of this are instructed in the guide, e.g. Recoll.

«

»

How Do I Update Whonix When They Release a New Version at whonix.org?

About once every 12-24 months, Whonix releases a new version with a new OVA template VM file containing an updated version of Debian Linux that brings many improvements, security features or performance upgrades. It's always very much recommended.

The best way to know what to do is to check an official support thread for this guide to discuss any new release from Whonix.

It's best to install a new OVA for each new major Whonix releases, then manually and securely move your old Workstation files and preferences to the new VM (like your Tor Browser Firefox profile and GPG keys), all inside your hidden VeraCrypt volume by using a temporary Virtual Hard Disk VDI file as instructed in the expanding storage how-to.

For the current instructions for upgrading from Whonix 14 to 15, see here.

«

»

I'm Running Out of Space. What Can I Do?

Manage space in your main VeraCrypt volume

- By default, Workstation VM has a 100 GB limit and is configured with Dynamically allocated storage. This means that the Workstation VMDK file expands inside your VC volume as you fill space in your Whonix, with a hard limit of 100 GB.

- When determining your free space in Tails, don't use the Disks app. Use the Files app: right-click in any folder in the VC volume and select Properties to see the accurate value.

- There may be deleted files in your VC volume which were not actually deleted but went into the trash folder, located in a hidden folder .Trash-1000 on the volume. Free up this space in your volume by checking and emptying the Trash in Tails Files app.

Manage space inside your Whonix

- To check your free space inside Whonix, open Thunar File Manager and the free space is displayed in the bottom status bar by default. To see a percentage calculation, hover the mouse over File System under Devices in the Side Pane.

- You can regularly empty the Trash by right-clicking on Trash in Thunar's Side Pane, then selecting Empty Trash.

Expand Whonix storage using free space in your main VeraCrypt volume

With VirtualBox, you can add an extra Virtual Hard Disk to any VM, and it's generated as a large VDI file in your hidden VeraCrypt volume next to your main VM files. Once set up, this is the most high-performing, convenient, and safe way to expand your Whonix storage.

To set up:

First install KDE Partition Manager in your Whonix-Workstation-XFCE. To install, in Terminal do:

sudo apt install partitionmanager && sudo sed -i 's+Exec=partitionmanager+Exec=pkexec partitionmanager+g' /usr/share/applications/org.kde.partitionmanager.desktop

Note: Due to a current bug in Whonix 15, to set up KDE Partition Manager, you then need to do this second step:

1. In Terminal do: sudoedit /usr/share/polkit-1/actions/com.ubuntu.pkexec.partitionmanager.policy

2. Enter changeme into the password prompt, then an empty file in Mousepad will open. Copy the below text into the file, save it, and close it off:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
  "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
  "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
<policyconfig>

  <action id="com.ubuntu.pkexec.partitionmanager">
    <message>Authentication is required to run KDE Partition Manager</message>
    <icon_name>partitionmanager</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>auth_admin</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/partitionmanager</annotate>
    <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
  </action>

</policyconfig>

Now power off your Workstation VM, copy the following text to read in Tails text file if necessary, and do the following in Tails VirtualBox:

Single-click the Whonix-Workstation-XFCE VM in VirtualBox and go to Settings > Storage. In the Storage Devices pane, in the Controller: line click on the hard disk button the the end of the line (a mouse hover says Adds hard disk.) and select Create new disk. Click Next, select Fixed size then Next, choose the size of the virtual drive as well as a custom name you want, then Create. Then click Choose and OK, and it will attach itself to your Whonix-Workstation-XFCE.

Power on your Workstation VM, and in it open KDE Partition Manager.

Under Devices, right-click on the VBOX HARDDISK item pertaining to the one you just created in VirtualBox (e.g. it may be /dev/sdb/) and select New Partition Table, then Create New Partition Table. Right-click on the large unallocated box and select New, then set File system: to exfat and click OK. Now click on the Apply button in the top left-hand corner right under File, then Apply Pending Operations, then close everything off by clicking OK and exiting the program.

To use:

Congratulations! Your Virtual Hard Disk is now ready to use. See it in Thunar File Manager listed as a hard drive under Devices named something like 50 GB Volume. Click on it and enter changeme if asked, and it's now mounted for you to use like any other folder in Whonix for that session.

Tip: If you do this as your principal method of Whonix storage expansion, you might want to set it to auto-mount at each Whonix startup and also mount to a specific folder location in Whonix. (Also, under this method, you should choose the arguably superior ext4 file system instead of exfat which is the more n00b-friendly option right now due to some GUI bugs.) In this example, it's a folder called called MyFiles under Home at the same level as Downloads and Desktop. In Terminal, do after the following example:

echo -e /dev/sdb1 /home/user/MyFiles ext4 defaults 0 0 | sudo tee -a /etc/fstab && mkdir /home/user/MyFiles && sudo mount -a && sudo chmod 777 /home/user/MyFiles

If you want to have spaces in the folder name of your mount path, you have to put the delimiter \040 for each space in the first instance of it in the Terminal command above, e.g. echo -e /dev/sdb1 /home/user/My\040Files for /home/user/My Files.

Note: Auto-mounting your Virtual Hard Disk in Whonix using the above tip has a caveat. If you somehow power on Whonix-Workstation-XFCE without it being able to access the VDI file (e.g. the storage media containing the file is not connected, you've deleted the file, or you've specifically detached it from the VM via VirtualBox settings), Whonix's internal Linux tries to mount the missing drive and fails, resulting in a command line-only troubleshooting 'emergency mode'. Luckily no data is lost, but to fix your Whonix you need to log into the emergency mode as root as suggested (input the usual changeme password), do nano /etc/fstab then use your arrow keys and backspace to remove the entire line that starts with /dev/sdb/ then save the file by pressing Ctrl-O then Enter then close off nano by pressing Ctrl-X, do reboot and it's fixed.

Thank you to fuax for getting rid of the bullshit.

Expand Whonix storage using space on external VeraCrypt volumes

Put your excess Files on external drives (in secure hidden VeraCrypt volumes) and access them from inside your Whonix. To do this, refer to the earlier mini-guides, Use External Drives with Whonix or Use VeraCrypt Inside Whonix.

Warning: NEVER use the Gateway VM for file storage. That VM can see your real IP address and therefore associate it to any data you place inside its local file system. Read more here.

Attach an existing Virtual Hard Disk file to a VM without errors

Usually you can attach an existing Virtual Hard Disk (e.g. VDI) file to a new VM by simply adding it in its VM settings like in the instructions above.

However, if you change the file name or location of the Virtual Hard Disk file, such as when moving from an old Whonix to a HiddenVM Whonix, there can be VirtualBox errors.

To easily fix that, do the following:

VirtualBox

File

Virtual Media Manager

Virtual Hard Disk

Remove

Release

Remove

Add

Virtual Hard Disk

Virtual Media Manager

Now you will be able to attach the file to any VM.

«

»

My Workstation Internet Has Stopped Working. What Do I Do?

If this happens, the easiest thing each time is to power off Whonix-Gateway-XFCE, then turn on again. Leave Whonix-Workstation-XFCE open and within about 30 seconds of Gateway's new session, Workstation should have Internet again.

«

»

My Whonix Is Starting to Slow Down. What Can I Do?

- Change Whonix-Gateway-XFCE to CLI mode as instructed here, as well as following all other recommendations in the Setup section.

- What is your hard drive setup? If Whonix is on an external USB, consider moving it to an internal motherboard-connected SSD, or at least a fast USB 3.0 drive. If using an old HDD, change to SSD, which gives a huge speed improvement.

- Upgrade your computer's CPU, RAM, and video card if possible.

- Is your Whonix the latest version? Check the Whonix website to stay updated. Also update packages in both your Whonix VMs.

- Check the list of startup services in Workstation's Linux system. Maybe you have downloaded a few apps you no longer use and they are launching services in the background without you realizing. To remove them from system startup, open Session and Startup from the Whisker Menu, go to Application Autostart tab and delete items you don't need anymore. For more advanced users who know what they're doing, check /etc/init.d/ (and delete items in Terminal after this example: sudo update-rc.d -f <service_name> remove), and also /etc/systemd/system/ (delete in Terminal after this example: sudo systemctl disable <your_service>). Be careful with these commands and make a full backup of your VM files beforehand just in case.

- Check that you haven't installed too many add-ons in your Whonix Tor Browser that you don't use anymore. They really slow Firefox down.

- Did you encrypt your hidden VeraCrypt volume with the super secure triple encryption AES(Twofish(Serpent) option, or double encryption like AES(Twofish)? If so, change it to simple AES which should be secure enough and will free up more processing power for everything else.

- Physically clean out your computer in case it is dusty (e.g. the fans). It can make the machine run hot and slower than it should.

«

»

What Is a 'tar.gz' / 'tar.bz2' File and How Do I 'Install' It?

Also called 'tarballs', tar.gz or tar.bz2 files are not necessarily installer files. It's just another compression and/or archive format like RAR, 7-ZIP, or ZIP. A '.tar' file is a basic archive container without any compression, and the '.gz' or '.bz2' is the extra layer that compresses it. You rarely find plain .tar files, and usually find compressed tar.gz / tar.bz2 files.

App developers often provide tarballs to distribute their source code, an executable script to easily install their program, a ready-to-use portable binary executable of the program, or other installation files like a .deb or a whole bunch of Linux architecture / distro installers.

To open a .tar.gz or .tar.bz2 file in Whonix, right-click on the file in Thunar then select Extract Here.

If you're a beginner, try to install programs only from Whonix's Debian repo via the easy Terminal sudo apt install <packagename> method, or find a 64-bit .deb file to install it by double-clicking on it (opening with GDebi Package Installer) as the second best method.

«

»

Thunar Tips / FAQs

How do I add folders to the left-hand pane as shortcuts?

To add a folder to the Places list in the in the Side Pane, right-click on any folder in Thunar and select Send To > Side Pane (Create Shortcut).

Can I have newly-opened folders to open as new tabs in the already-open Thunar instead of creating multiple windows all the time?

Yes. In Thunar File Manager select Edit > Preferences > Behavior and tick open new thunar instances as tabs.

«

»

OUTRO

Reminders and Recommendations for Safe Practice

Never Share Your Whonix Computer

Do not share your Whonix computer with anyone who you don't want to find out about your files.

Do not mount your Whonix on a computer whose hardware you are not in full control of.

If you do share the computer with someone you don't think would be suspicious, make sure that their OS is encrypted and cannot be accidentally seen by Tails when you use "Hidden Whonix".

«

»

Regularly Backup Your Whonix

With computers, anything can go wrong that can result in sudden catastrophic loss of all your data and with no easy way to recover it. Files that can get corrupted include the VirtualBox VMs (i.e. the VMDK or VDI files) inside your VeraCrypt volume, or the entire VeraCrypt volume itself. The Tails USB can also become corrupted if you ran out of memory and had to force the computer off in a non-ideal way. These times are rare, but it can happen.

To backup your Whonix in Tails:

VirtualBox

Terminal

sudo apt install gdebi

Tor Browser

SECURITY LEVEL

Safest

VeraCrypt

Downloads page

Debian 10

GUI

.deb

Open With Another Application

GDebi Package Installer

Select

VeraCrypt

Win

ver

VeraCrypt

Create a Hidden VeraCrypt Volume

VeraCrypt

Unlock VeraCrypt Volumes

VeraCrypt

HiddenVM

Note: The transfer process between two highly secure VeraCrypt volumes like this can take hours depending on the speed of your USB / hard drive / CPU, but it's worth it for the safety it provides. Invest in a large USB drive, and back up your Whonix on a regular basis. You'll be thankful later.

«

»

Only Use Your Whonix for Online Activity

Don't do anything related to your RL in your "Hidden Whonix". Malware or spyware inside your Whonix such as in the Tor Browser may mean that you are super anonymous, but you're being watched.

Another way to dangerously connect your identities is moving a previously-viewed file into Whonix and then opening it in Whonix. A local .html file could load remote Internet resources like images when you open it in the default OS browser. A PDF file would have hyperlinks in it which when clicked on send 'HTTP referrer' info over the Internet that links the PDF your IP address. If such files are obscure or unique enough, you have possibly linked your identities as clearly as if you Googled your real name both outside of Whonix and then inside Whonix in the same minute.

Think carefully about separating your identities, including their associated files, data, and habits. If you have this attitude, you will naturally realize when you shouldn't do something, or you will at least be mindful of the risk.

«

»

Use Whonix Gateway as Minimally as Possible

As the Whonix project advises, never use the Gateway VM for actual Internet browsing or anything other than the bare minimum functions to do the Tor connecting or to apply its maintenance or security updates. It is not bullet proof against IP address leakage like Workstation is, so you should never do anything incriminating inside it.

«

»

Be Aware of Browser Fingerprinting

The one disadvantage of enabling JavaScript or other plugins inside Whonix is that although you are completely safe from IP address leakage, a different set of tools to 'track' you become available, all of which rely on JavaScript.

Even if you turn JS off, your writing style can identify you anyway. Simple linguistic analysis can identify your regional origin based on idioms, grammar or spelling choices that you didn't realize were normal only to your area and not elsewhere in the world. Big data and machine learning at Google and NSA are working hard to give every individual a signature based on text data alone. We should now accept that such entities (and, increasingly, lower-level LEA) know who is who online.

With this in mind, VeraCrypt's deniable encryption as instructed in this guide is important for every file sharer. They may track you down to your IP address or RL identity, but if your HDD shows nothing, you are innocent in court. Only file producers or file site admins need to do more things than what's recommended in the main guide, where police might hide outside your house and try to seize your computer while it's still on and unencrypted (i.e. they ambush you).

«

»

Safety Precaution for File Sharing

Hidden files in any OS - even on Linux, e.g. .directory files - can contain scary metadata revealing private or deanonymizing data like system username, timestamps revealing clues about your timezone, or other data. Before you ZIP that image folder up for a site, please check that no personal metadata is hiding in there that shouldn't.

To be safer, you should always be viewing hidden files by default in Whonix. In Thunar File Manager, tick View > Show Hidden Files by default to make sure you don't accidentally upload privacy-compromising hidden files. Use software like mat2 to sanitize your images, videos, which can contain GPS data or other identifiers from your smartphone or camera model.

«

»

Concluding Thoughts

All file sharers should make the effort to adopt "Hidden Whonix" for all the reasons outlined in the INTRO.

You will get used to the quirks, limitations and unique possibilities that Whonix on Tails has. You will come to love the feeling of security and safety in your encrypted little world, a feeling of relaxation in the back of your mind when downloading or sharing files!

Never let this safety be an excuse to start practicing bad security habits, just because you're in Whonix. Instead, Whonix is a way to enrich both the safety and possibility of what you can do online.

We should all use Whonix to increase the safety of the entire paranoid community. The safer one of us is, the safer all of us are.

So come try it out and stay safe!

«

Changelog and News

Changelog

This is a record of improvements or milestones of the guide. It does not always mention everything, but sometimes only big things.

2020-07-04:- Launch of Guide v3.0. Tails is now the mandatory host OS. HiddenVM is the tool that allows us to run Whonix on Tails. This is the biggest upgrade in safety since the launch of the original Guide. BIG moment!
2020-07-02:- In multiple locations in the guide, added important tip to never re-use your VC volume password anywhere else.
2020-06-30:- New instructions for using external drives with Whonix. Now simpler and safer method thanks to Tails.
2020-06-23:- Added tip for how to make VeraCrypt volumes larger than 2TB in size.
- Added ADVANCED TIP for how to move files between whonix and RL worlds more safely.
2019-10-18:- Added a how-to under 'Performance Optimizations' for speeding up VM boot time (remove splash and boot screens).
- Introduced new sharper font for 'Improve Whonix Appearance'.
- Added 'Prevent long shutdown' to a new 'Random Whonix Bugfixes' section.
2019-10-13:- Launch of v2.5 of the guide. Updated for Whonix 15, new screenshots, and more.
- Dropped support for macOS as a host OS.
2019-05-26:- Added a how-to 'Disable JavaScript on specific sites' in 'Post-Install Steps'
2019-04-22:- Added instructions for turning off advertisements in JDownloader.
2019-04-19:- Updated Setup instructions to reflect the Whonix Project's change of now offering the dual VMs in a single OVA file.
- Added Foxit Reader in the guide as an excellent PDF reader default for Whonix.
2019-04-07:- Updated the default recommended 'Image Viewing' program to XnView MP with provided customizations.
2019-03-01:- Bugfix in VirtualBox host OS install instructions.
- Now recommending to disable 3D / 2D acceleration for Workstation due to security advice. Thanks Old Lurker!
2019-02-01:- Updated the 'unpack' script (in JDownloader section) to not create an extra subdir for extracted files. Neater IMO.
- Added cool tip about JDownloader's backup/restore function in its mini-guide. Thanks Jamie_Boy!
- Added MediaInfo mini-guide for inspecting any media file.
2019-01-19:- Added a critical security step to the SETUP section, 'Turn off VM 'Preview' in VirtualBox'.
- Added instructions to Post-install Steps to enable languages like Korean to display properly in Whonix.
2019-01-12:- Image Viewer how-to improved with plugins add-on.
2019-01-04:- New Year's gift! Guide updated to v2.1 for Whonix 14 Xfce! Too many improvements to list. HUGE UPDATE. NOW WAY FASTER.
2018-12-25:- Christmas surprise! Guide now updated to v2.0, Whonix 14! Sorry, too many improvements and too little time to list them here. Just enjoy!
2018-07-31:- Added how to set a hotkey to toggle Dolphin/Terminal/any app in Whonix in the 'Further Tips' section.
2018-06-15:- Added the 'Virtual Hard Disk' how-to for expanding your Whonix storage.
2018-06-11:- Added how to back up your Whonix under 'Regularly Backup Your Whonix'.
2018-06-10:- Added how-to rotate videos (HandBrake, now 'Basic Video Editing').
2018-06-09:- Added tip for how to check the IP address in JDownloader.
- Added a mini-guide for 'Basic Image Editing'.
2018-06-08:- Added a tip for how to fix jerky video playback in VLC.
2018-06-07:- Added a suggestion tip for Mac hardware users to create a macOS bootable USB installer disk in 'SETUP'.
2018-05-31:- Added a post-install step to disable 'non-free' check (an annoying default pop-up).
2018-05-27:- Added a mini-guide for combining a video + subs into single MKV without reencoding.
2018-05-23:- Updated, cleaned up and finalized the SSD wiping section under 'SETUP'. It's now no longer a nightmare.
2018-03-13:- Added PeaUtils, a GUI tool for checksum/hash and join/split file.
2018-03-12:- Noted a current limitation of the archive file auto-crack and extract script.
2018-03-11:- Updated the method for creating archives to be much easier and now on-par with Windows. - Added a tip for how to view massive photo folders or collections in Whonix.
2018-03-06:- Added privacy tip to FIU mini-guide.
- Added tip about how to update FIU easily from within the app.
2018-03-04:- Added a script to auto-crack and extract files when JDownloader's workflow fails.
2018-03-02:- Made installing VirtualBox Extension Pack as a default instruction in the setup steps.
2018-03-01:- Added extra detail for how to protect hidden VeraCrypt volume when outer volume is mounted.
- Added a tip for how to make GIMP actually nice to use (like Photoshop).
- Made hint about Opera hijacking the default browser status and how to fix it.
2018-02-23:- Made the VPN method much better in the 'Unblock Sites That Block Tor IPs' mini-guide.
2018-02-22:- Added 'xterm' to post-install steps. - Clarified the 'The Internet has stopped working' FAQ adding details about what it can look like.
2018-02-21:- Improved and clarified instructions in the Setup section. - Added keyboard shortcut how-to for 'Shut down' (two options).
2018-02-20:- Added browser add-ons tip to 'My Whonix is starting to slow down' FAQ.
2018-02-19:- Launch.

News

June 2020: v3.0 Guide launched, move to the HiddenVM method: A new era of safety for all users

Version 3.0 of this Guide is the biggest increase in safety and security since the launch of the original Guide on some fucked site probably.

Not much was changed in the how-to's for how to do things inside the Whonix VM. Most changes are in the shift in host OS to Tails, and you getting used to Tails as a different feel for how your computer runs.

Some default security recommendations have even gone because Tails is a fundamentally higher level of security to a normal static Linux host OS. For now, almost all former security precautions remain as tips remain for 100% paranoid users.

Everything in the Guide has been tested on the latest Whonix-XFCE-15.0.1.3.4.ova published by the Whonix project at the time of 3.0 publishing. Hopefully it is bug-free enough for you to try out without too much trouble.

To upgrade a Whonix 14 Xfce to a Whonix 15, see here.

To move an existing Whonix into HiddenVM, see here.

Spread the word

If you are passionate about promoting this project, why not put a link to the guide in your forum profile signature? Go to your signature edit box and use something like this:

[b][size=100][bgcolor=#563D7C][color=#166FA6][/color][color=#F7F7F7]"Hidden Whonix" Guide. Stop using Windows. Start being safe.[/color][color=#C13B5B][/color][/bgcolor][/size][/b]

How to Securely Wipe Your SSD / HDD

Note: This is when you should confirm that Tails works on your computer. Some hardware can be problematic such as newer Apple computers. Create a Tails USB, and test it out. If you're having problems, let us know in an official support thread and we will try to improve the guide with more pointers. If it just doesn't work, you may have to buy another computer to move to "Hidden Whonix".

Are you migrating from Windows, macOS, or another Linux setup to "Hidden Whonix"?

Before you do, and after you've backed up any existing files securely into a hidden VeraCrypt volume, you should wipe your hard drives thoroughly.

Note: This is a very detailed set of instructions that will satisfy the most paranoid user possible. The only thing more secure than these steps - and you should actually consider it - is to physically destroy an existing SSD that has had unencrypted files on it.

You don't have to try all these steps. Decide what you'd like to do. All steps are included so that even the highest-level targets can refer to this. What you should do depends how paranoid you are, how much time you have, and how much money you have.

Tip: How do I boot from a USB? On most PCs, at bootup you repeatedly press either F12, F2 or Del to choose to boot from a USB Hard Disk. If that doesn't work, research online or find out by exploring your BIOS. On Mac hardware, hold down the alt key at bootup.

If your disk is an older-style spinning HDD (and not an SSD), do your disk wiping with DBAN. In your current operating system, Download the ISO from SourceForge, download and use balenaEtcher to flash the ISO to a USB. Then boot from the DBAN USB. Follow DBAN's wizard by simply pressing Enter for the default option, which is secure enough for most people's needs, or choose other options if you are really paranoid. Congrats, your HDD is now ready to put "Hidden Whonix" on it, so continue following the guide.

But if your disk is an SSD, secure data erasure is more complicated, but quicker to perform. Continue below to perform all of the next steps on your SSD, which together will satisfy 99% of users.

Warning: The following secure erase commands must be performed while the SSD is directly connected to the motherboard via internal cable such as SATA or PATA (IDE), otherwise the commands may permanently break the drive. If you want to securely wipe an SSD from an external enclosure, you must take it out and connect to your computer directly via SATA/IDE cable (instead of through USB / Firewire / SAS / SCSI / RAID card). Try the commands on a USB thumb drive (or USB-connected large external drive) but do so at your own risk, with possibly less risk by using the very latest version of hdparm.

First, locate your SSD manufacturer's official utility provided for procedures like updating firmware, data erasure and disk maintenance. It may take some effort to determine the actual manufacturer of your SSD inside the drive (which can be different from the brand displayed on the label), such as through physical inspection of the SSD or detailed device driver lookups in your current host OS.

Once you determine the real manufacturer, download the official 'live CD' (or USB) ISO provided on the manufacturer's website. Download and use balenaEtcher to flash the ISO to a USB, and boot from that USB.

Note: With many SSD models, the only way to create a bootable utility disk is via a Windows utility. So if you're not already coming from the Windows environment, you may have to install Windows just for this process, or in the case of a Mac, install a temporary Windows in VirtualBox or Parallels (or Boot Camp). Additionally, for Mac SSDs, there can be no official manufacturer utility compatible with the drive, depending on the SSD model.

Booting from your SSD's official utility, first update the firmware of your SSD if possible. This helps you gain the highest chances of actual data erasure in the steps below.

Then: perform every tool you see that seems related to data wiping or resetting, including 'sanitize', 'crypto scramble', or 'secure erase' tools. Unlike DBAN's process for magnetic HDDs which can take hours, most of these steps will be quick, and they are important to perform. With some models, only the official manufacturer utility can do it properly because they have the most knowledge of the inner workings of their particular model's firmware implementation of the ATA Security commands.

Next are similar data wiping steps as the above, but this time, with fully open-source software which we can therefore trust a lot more.

Boot into your Tails USB and come back here to continue instructions. (For how to install Tails and read this guide safely inside it, see instructions here.)

Then: install the latest version of hdparm in Tails. Open Root Terminal in Tails, and do: apt update && apt install gdebi -y. Then download hdparm's Debian testing version here. Open the containing folder of the DEB file, right-click on it and select Open With Another Application. Select GDebi Package Installer. Click the blue Select button. It will guide you to install it.

Then in Tails Root Terminal do: fdisk -l | grep "Disk /dev/sd" to carefully determine which disk in the list is the one you want to wipe, by checking their disk size. The examples below are for sda, but yours may be different.

Optionally: if paranoid, do after this example to perform a basic software-level disk overwrite, which is worth doing just once, even on an SSD: dd if=/dev/urandom of=/dev/sda bs=1M. Wait for the screen to return from the flashing cursor to the normal prompt, and beware that this optional step could take hours (e.g. 9 hours for a 2 TB disk). It depends on the size of the SSD.

Then: first try hdparm's SANITIZE commands. Try the following three commands, and if after the first one hdparm says SANITIZE feature set is not supported, continue to the next set of commands because these three ones won't work:

hdparm --yes-i-know-what-i-am-doing --sanitize-crypto-scramble /dev/sda

hdparm --yes-i-know-what-i-am-doing --sanitize-block-erase /dev/sda

hdparm --yes-i-know-what-i-am-doing --sanitize-overwrite --pattern=/dev/urandom /dev/sda

Help: Someone with a SANITIZE command-compatible SSD needs to verify if that third command works! Can you help? Report your results in an official support thread.

Below are some more widely-compatible hdparm ATA Security commands.

Do after this example: hdparm -I /dev/sda | grep frozen

If its output says not frozen, continue to the next step. If it only shows frozen, you need to unfreeze the SSD drive. Press the Win key and search for Settings and open the Settings app. Select the Power item in the sidebar menu, and set When the Power Button is pressed to Suspend. Then short press the power button to suspend the computer. Wait about 20 seconds when it has entered the suspend state, then short press power button again. Now go back to Tails Root Terminal and do the above command again. If it says not frozen you can proceed to the next step.

Tip: If you are still having trouble unfreezing the drive for hdparm, try some further methods posted online here and here. Further methods include hot re-plugging an SSD drive via either its SATA and/or power cable while Linux Mint is running. Also, you may need to enable AHCI in your computer's BIOS for it to work, read here.

Now, do after this example: hdparm --user-master u --security-mode m --security-set-pass 'temppassword' /dev/sda && hdparm -I /dev/sda and make sure the output shows enabled near the top, without a not before it.

Next: in the same output, if it shows supported: enhanced erase, do after this example:

hdparm --user-master u --security-mode m --security-erase-enhanced 'temppassword' /dev/sda

But if it shows a not before supported: enhanced erase, do after this example:

hdparm --user-master u --security-mode m --security-erase 'temppassword' /dev/sda

For the commands above, it could take some time if it is a large drive but you can find an estimate of how long either command will take by first doing hdparm -I /dev/sda and reading the output where it will say something like 9min for SECURITY ERASE UNIT. During command operation, wait for the Terminal to return to the normal command prompt, which is how you will know the process is done.

Congratulations. This completes the most exhaustive set of steps possible to wipe an SSD using software. Your SSD is now safe to install Whonix on it. Continue to the next step in the Guide.

Note: For further reference and information about all the above SSD wiping procedures, visit these four links.

Warning: If you have file data that was at any stage unencrypted on an SSD (not a magnetic HDD), then be aware that there are small possibilities that data traces can still be present in hard-to-erase areas in the SSD cells. This is extremely unlikely, but technically possible. There is no open-source software method or inexpensive at-home forensic procedure to verify for 100% sure that your data is irretrievable after performing the above steps. This concern is only applicable for users at the highest level, i.e. 10/10 paranoia. If you cannot afford to trust any form of data security outside the mathematics of open-source cryptography (and note that this concern also applies to HDDs), then you will have to physically destroy the disk, buy a brand new disk, and consider this an expensive education in file data safety.

How to Shrink or Optimize an Animated GIF in Whonix

This guide shows how to make an image like the one below demonstrating how to use the Terminal.

It's possible to make some very sexy GIFs - especially clips that perfectly loop! AGIF can be a low file size if it's of avatar-size (or signature size) and if the loop is also under 1-2 seconds or 50 frames. It's possible to make an effective GIF without clogging up users' page loading.

Note: The animated GIF format was NOT invented for GIFs like the example above. It was meant for 3D vector-based animations in loop format like the 'live' logo images from websites in the 90's - not for photo-realistic, JPEG-type stuff like today's GIF memes. It took a long time to produce the example above - it's a miracle GIF - and it's still 3.5 MB, i.e. too big!

The actual image format of each frame in an animated GIF is lossless PNG. That's why file size reduction is difficult. Without the compression and lossy possibilities like JPEG, you have to save space in other weird ways like limiting color range (from 256 down to 64 or even 32), and generally being creative with your design.

Here's seven steps using Linux command line tools

If a package below like gifsicle is not installed, install it via: sudo apt install <packagename>.

1. Find a GIF you want to make smaller. (Or you can create a new one from a slice of video yourself.)

2. First know what final output pixel size it's going to be. This will affect the file size the most of all. If it can be smaller pixel-wise, make it smaller at the start. Start with the file size you want (at the early stage of your folder of image frames) then work with that final size in all the steps such as the mp4 bottleneck, as the result will be much better quality.

3. Split the source GIF into its individual frames (you need to sudo apt install imagemagick first), do: convert -coalesce original.gif %07d.jpg (Then move the original GIF into different folder to the split frames.)

4. Here is where you can optimize the size a great deal by deleting unnecessary frames from the source. Read more in the notes at bottom. Cycle through the frames in your image viewer and curate them deleting the ones not needed for your final product.

5. Convert the frames into MP4 video format: first you must rename the files to perfect numerical order with this command: num=0; for i in *; do mv "$i" "$(printf '%04d' $num).${i#*.}"; ((num++)); done then do in the frames folder: ffmpeg -framerate 10 -i %04d.jpg -c:v libx264 -profile:v high -crf 20 -pix_fmt yuv420p mp4export.mp4

6. Then convert that MP4 to animated GIF: ffmpeg -i mp4export.mp4 animated.gif

7. Now it's time to optimize in a few ways (I've separated them into separate steps so you can preview the various space savings of each step): gifsicle -O3 animated.gif -o animated_o.gif then to reduce colors from 256 to 64: gifsicle --colors 64 animated_o.gif -o animated_o_c.gif (And do try 32, it may look OK enough and it saves decent space.)

Other tips and notes

- It's much more time consuming, but you can specify custom time gaps between each frame instead of the same between every frame. So instead of having 10 repeated frames for where a GIF pauses for one second if it's a 10 FPS GIF, just have one frame pausing for 1 second, cutting out 9 unnecessary frames out of the picture. Cutting frames out makes a big difference. You can even do this in GIMP and craft a whole animation between frames like as in Photoshop. AGIF file size is not so much about loop length, as number of frames, no. of colors per frame, pixel size per frame, and a few other ideas.

- To emulate your source GIF accurately you must know the gaps per frame value of the original GIF ('10' is 100/10 aka 10 frames per second equivalent), and it must have a constant 'frame rate' in order to be easily emulated as such. Some GIFs can have different value between different frames such as an already-optimized GIF.

- To combine a folder of image frames straight to animated GIF: convert -delay 10 -loop 0 *.jpg output.gif and for a longer / shorter pause between every frame, increase / decrease the delay number accordingly. This method makes far too big a GIF so instead I've instructed the mp4 intermediate step above.

Security, Privacy, and Anonymity ADVANCED TIPS

Note: These tips are based on the assumption the you already are using Whonix in Tails as per this guide and already taking into consideration every other tip and suggestion offered in the main Guide. These are only extra tips after all that.

- Password-protect your BIOS / UEFI or Mac firmware. Securing your BIOS / UEFI or Mac firmware gives strong protections against attacks like Internet-planted UEFI rootkits or Evil Maid-planted bootloaders or hidden devices impersonating your own, which can secretly capture your PC login passwords and all your data. If you are a high-value target, these attacks are more likely to be used by LEA to maximize their success of prosecution if they think you use plausible deniability and seizure-proof encryption. If you set a BIOS/firmware password and then they try to tamper with your BIOS, your BIOS password may reset and you will know you are being targeted. LEA however can plant many types of physical spying devices or hidden hardware keyloggers in your computing environment if they are directly targeting you for prosecution, so the usefulness of this is mostly to prevent dangerous malware delivered remotely. Use this reference if you are interested in this tip.

- Give your SSD its own extra access password without slowing it down. As a precaution against some attacks (like pre-FDE malware 'bootkits' in the bootloader area that can capture your host OS password) or LEA forensics upon SSD seizure, after wiping your SSD you can give it its own password which must be entered for any operating system to be able to then write to the drive. This 'ATA security' technology is called 'self-encrypting drive' or 'SED', and it uses AES-256 encryption at the SSD hardware level. It does not protect against key disclosure laws, but provides meaningful protection against advanced malware that could be placed on LEA-hijacked sites or in other attack situations. To set up, first unfreeze the drive via the SSD wiping instructions elsewhere in this document, then do after this example: hdparm --user-master u --security-mode m --security-set-pass 'mySEDpassword' /dev/sda. To use, at the beginning of each session to access your files, in Tails' Root Terminal do after this example: hdparm --security-unlock 'mySEDpassword' /dev/sda && partprobe. Tails can then access your hard drive as normal. The SED will remain unlocked through any other Tails reboots until you fully power off. To remove this feature and return the SED to work like a normal HDD again, unfreeze the drive once more then do after this example: hdparm --security-disable 'mySEDpassword' /dev/sda. Read these pages for reference and more info.

- Lock down your Whonix computer's hardware sensors to avoid malware exploiting them. Don't trust software alone to disable your computer's in-built webcam, microphone, audio speakers, radios like Bluetooth or WiFi, etc. Take apart your computer and physically remove unwanted sensors. Malware or default Tails settings could activate them without you knowing.

- Avoid ultrasound cross-device ad tracking / deanonymization between your phone and/or multiple computers. This one is scary. Passive ad tracking on your smartphone (like the Facebook app) using sensors (like your mic and probably other sensors like visual infrared dot projectors, Face ID) can powerfully link your online activity to your RL smartphone. Your keyboard makes sounds which can leak which keys you are typing via audio analysis of their sounds. Your monitor's screen emits ultrasound frequencies that can be 'filmed' through ultrasound audio analysis (from your phone). This could happen in the other direction, e.g. Linux malware planted by LEA on online sites (browsed in your Whonix) could be coded to listen via the microphone to capture audio from your computer's surrounding physical environment, to deanonymize you as a Tor user. To mitigate this, disable ads via ad-blockers (and a more powerful, effective, and safe to do this is via your hosts file using this list). Disable the microphone in Tails and any VMs by default. Turn the speaker sound off as much as possible when not in use (full mute). Use headphones instead of speakers when possible. Turn off smartphones when browsing sites or consuming content. Use a safer de-Googled Android phone without GApps on it. Avoid home speakers like Amazon Echo, Google Home, Apple HomePod etc.

- Got an old Android phone? Install Snowden's Haven app for intrusion detection and monitoring when you're away from your devices. Or buy a cheap $50 used Android online, making sure it has enough sensors to be useful for Snowden's app performing surveillance when you're away. This could let you know if LEA have planted powerful malware, hardware keyloggers or other spying devices on your computer or in your vicinity while you're away, or just others that you think may be suspicious of your devices and are trying to break into it - or generally snoop in your area while you're away.

- Make your online site account password 'styles' unique, and not like how you do elsewhere. A site could get hacked and your user account password is leaked in plaintext form. If there is anything in your account password that shows a certain 'personality', style, or similar syntax pattern to your RL passwords (or perhaps an old Yahoo! account, which now has millions of leaked passwords), that can be cross-referenced with other leaked databases by LEA who could thus identify you.

- Be careful in moving any files, images or videos between whonix and RL worlds. LEA can embed steganographic tracking code into media files. This is hidden information that you cannot detect with the naked eye or rely on detecting through with steganography detection software. These watermarks implanted by LEA in images could be used to track the spread of files online and who is associated with them. Because this is technically possible we should assume that LEA are doing this. NEVER transfer a file that you found on a site to RL computers or RL online accounts, even if it is legal content. Instead, you can transfer it with a degree of deniability by posting the file while in Whonix onto a Clearnet site which is easily accessible in public, which means anyone could have grabbed the file instead of you. Later, you can download it from the Clearnet site in a RL setting with plausible deniability of being the original uploader. If you move a file directly from your Whonix to a RL computer - or vice versa - it could contribute to you being deanonymized.

- Don't use the same password or password style across different parts of your computing. There are various ways in which your Whonix activity - such as a password you type in your keystrokes - is not as private as you think. Sites might be taken over by LEA and implant JavaScript malware which starts listening in - e.g. a keylogger inside Whonix. Don't use the same password for what you use to unlock your BIOS, SED, or Tails environment, as passwords you use in any situation in your Whonix such as PGP passwords or online accounts. As warned in the guide, the worst one of all is duplicating the password or password style of what you use to unlock your main hidden VC volume. Have a different set of passwords and password styles for every particular environment you're in.

- Learn to 'panic shut down' Tails in the proper way. In responding to the situation in which LEA may raid you while you are using the computer your VC volume unlocked, only shut down Tails by physically pulling out the USB stick, or via the software menu in top right-hand corner. These methods securely erase the RAM by writing data to it before very quickly shutting down the OS. Do not long-press the machine's power button or kill the power as your method, which is susceptible to cold boot attacks that LEA could use.

Mini Migration Guide to Move to a New Workstation VM

Tip: For a few reasons, it's suggested to upgrade major Whonix versions (such as 13 to 14, 14 to 15, etc.) by importing a new OVA instead of upgrading in-place your existing Workstation VM. Even if the risk is rare, it's a chance to discard any malware in the VM. It may speed it up if you have unused programs that are clogging up your autostart and shutdown scripts. It may also be necessary if the Whonix project advises it.

This mini migration guide is for migrating any Xfce Whonix Workstation version to the current version offered by Whonix project, e.g. from Whonix 14 Xfce to 15, or from 15 to 15.

Before you begin

- Backup your current Workstation VM into an external hidden VeraCrypt volume. Have a complete clone of your existing, working VM, so that you can go back to it if something goes wrong.

- Make sure you have enough space in your main hidden VeraCrypt volume to temporarily have extra space while copying files over into the new VM. If you accidentally fill up your last free byte in the volume when generating new Whonix files, major problems can occur and you have to start again from your backup.

Four migration steps

Step 1: Install the new VM next to your current one

- Follow the Guide v3.0 from the beginning up until "Install HiddenVM" section, to install the new Workstation VM.

- To access your old Workstation in HiddenVM, refer to this migration guide.

Tip: To enable Internet on multiple Gateway / Workstation pairs at the same time, in VirtualBox go to Gateway VM's Settings > Network > Adapter 2 and change Name: from Whonix to Whonix2 then click OK, then Workstation VM's Settings > Network > Adapter 1 and change Name: from Whonix to Whonix2. Then restart all VMs if necessary.

Step 2: Move your Files from the old VM to the new VM

There's multiple ways you can do this:

- Set up an identical Shared Folder in both VMs to easily move files between them using that folder as an intermediary. Shared Folder instructions here.

- Create a temporary Virtual Hard Disk file (VDI file) in VirtualBox attached to the old VM. Refer to storage expansion guide for instructions. After move all files into the VDI file, attach it to the new VM to import.

Step 3: Re-install programs in the new VM to emulate your old VM

Simply refer to the Guide to install new programs and set up your new VM as you like it.

Step 4: Copy your program settings to the new VM

First, fully update your old VM by doing in Terminal: sudo apt update && sudo apt full-upgrade. Try to ensure there are no more updates reported to perform by repeating that command again. To potentially fix a kernel update error, do: sudo dpkg --configure -a

Now, you can copy over your program settings and files after they've been installed in Step 3. Here are some examples of how:

Thunar Custom Actions
- Move over the file ~/.config/Thunar/uca.xml
Tor Browser (history, bookmarks, open tabs, website passwords, add-ons, settings)
- In the new VM, close off Tor Browser. Go to ~/.tb/tor-browser/Browser/TorBrowser/Data/Browser/ in Thunar File Manager and delete the profile.default folder.
  
  In the old VM, close off Tor Browser. Copy the old VM's ~/.tb/tor-browser/Browser/TorBrowser/Data/Browser/profile.default/ folder into the new VM location.
  
  Open Tor Browser and it will all be there.
  
  If your bookmarked locations in file save dialog did not transfer, try again to copy over the file ~/.tb/tor-browser/Browser/.config/gtk-3.0/bookmarks.
Firefox ESR
- Copy the old VM's profile folder in ~/.mozilla/firefox/ and overwrite it in the new VM, but rename it to the new profile folder name before starting up W15's Firefox ESR.
Opera
- Replace the entire ~/.config/opera/ folder.
JDownloader (password list, app settings, unfinished downloads)
- Go to File > Backup to backup then restore your entire JDownloader settings to the new Whonix. When creating the backup file, wait for JDownloader to load again for the .j2backup file to be fully created.
gpa (PGP keys - both yours and others' you communicate with)
- In the old VM's gpa, under Windows > Keyring Manager first select other people's keys and do Keys > Export Keys... then individually select your key(s) and do Keys > Backup... and modify the file name in the file save dialog.
  
  In the new VM's gpa, under Windows > Keyring Manager do Keys > Import Keys... and select other people's keys. Then do the same for your own private key(s).
Thunderbird (emails, accounts, program settings, Enigmail PGP)
- Replace the entire ~/.thunderbird/ folder. Create it in the new VM if it does not exist yet.
LibreOffice (program settings, custom dictionaries)
- Replace the entire ~/.config/libreoffice/4/user/ folder. Create it in the new VM if it does not exist yet.
VLC (preferences, recent video history)
- Copy over ~/.config/vlc/
ClipIt (clipboard history, preferences)
- Copy over ~/.local/share/clipit/
HexChat (accounts, chat history, settings)
- Copy over ~/.config/hexchat/
AutoKey (your scripts)
- Copy over ~/.config/autokey/data/

Other things to consider:

Check your old VM's ~/.config/ folder for other useful program config folders to copy over.

Startup apps in whonix: copy over ~/.config/autostart/

Other system or built-in app preferences like Thunar, Mousepad or other system settings: best to emulate manually in your new VM settings.

Finally

Keep a copy of your old VM for a while, in case you forget to copy over something important.

CONGRATULATIONS. YOU'RE IN YOUR NEW WHONIX OVA. ENJOY!

Mini Migration Guide to Move an Existing Whonix Into HiddenVM

Before you begin

- Update your current Whonix's VirtualBox version to the very latest official stable version as shown on the virtualbox.org website. HiddenVM always uses the latest version and just in case VirtualBox changes the way config files are structured between versions, have them matched up for a smooth import. The easiest way to update to the latest is to download the official installer file from the virtualbox.org website that pertains to your current operating system.

- Test Tails to make sure it works on your hardware. You could even practice completely installing "Hidden Whonix" from scratch by following the main guide as a new Whonix user. At least make sure Tails run, so that you don't accidentally waste your time.

Three migration steps

Step 1: Backup the existing Whonix to an external VC volume

- How to backup: In your current host OS where you use your Whonix VirtualBox, create a hidden VeraCrypt volume in the correct way using these instructions. If coming from Linux, you might only need one extra hard drive. If coming from Windows/macOS, you will need two extra hard drives. After your VC volume is created, mount it and move your Whonix files into the volume.

- What to backup: All of your VM files for both Whonix-Gateway-XFCE and Whonix-Workstation-XFCE including their .vdi hard drive files, .vbox config files, and any Virtual Hard Disk expansion files that may be attached to them. Locate your VirtualBox VMs folder containing the subfolders for both Whonix VMs and copy the entire thing into your VC volume.

Step 2: Install HiddenVM

- Follow the new Guide from the beginning up until "Install HiddenVM" section.

- Take note of any new security advice in the Guide since v2.5. Tails as a host OS brings a lot changes. Some suggestions are now automatically safer and therefore more convenient. Other things to read are tips for how to make a VM on Tails a smoother experience.

Step 3: Import existing Whonix files into HiddenVM

Once you have installed HiddenVM and its VirtualBox window pops up for the first time, it's time to manually import your backed up Whonix into this new VirtualBox:

Files

VirtualBox VMs

HiddenVM

VirtualBox VMs

VirtualBox

File

Virtual Media Manager

Add

Virtual Hard Disk

Virtual Media Manager

Machine

Add

HiddenVM

CONGRATULATIONS. YOU'RE IN HIDDENVM. ENJOY!

"Hidden Whonix" Guide

Tails | Veracrypt | HiddenVM | Whonix

Contact:

"Hidden Whonix" Guide

v3.0 - Tails | HiddenVM | Whonix 15

INTRO

What Is Whonix?

What is HiddenVM?

What is Tails?

Why You Should Use "Hidden Whonix"

Why not use Tor Browser in a normal OS like Android, iOS, Windows, macOS, or even Linux Mint?

Why not use Whonix inside a regular Linux Mint host OS like the Guide pre-v3.0?

Why not just use Tails on its own?

Other benefits of Whonix

How to Use this Guide

Navigation

Formatting and color map

SETUP

Setup Instructions

Create a Hidden VeraCrypt Volume

Securely Backup Any Existing Files

Securely Wipe Any Existing Unencrypted Files

Install Tails

Install HiddenVM

Install Whonix

Step 1: Download Whonix

Step 2: Import Whonix into VirtualBox

"Hidden Whonix" Is Ready to Use

Recommended Settings to Optimize Your VM

Hardware Virtualization

Performance Optimizations

Security Optimizations

Post-Install Steps

Essential Tools You Must Install to Follow This Guide

Random Whonix Bugfixes

Prevent long shutdown

Improve Whonix Appearance

Fix blurry fonts

Make Whisker Menu look nicer

Turn off Private Browsing Mode

Disable JavaScript on Specific Sites

Enable Win Key Shortcuts of Any Type

Add Desktop Icons

Add Support for Other Languages in Whonix

HOW-TO'S

How to Use the Terminal

Essential Mini How-To's and Recommended Programs

Move Files into Whonix

Use External Drives with Whonix

Temporarily connect an external drive to your Whonix

Permanently use an external drive in your Whonix (plug and play capable)

Use VeraCrypt Inside Whonix

Unblock Sites That Block Tor IPs

To use a VPN IP with non-browser programs in Whonix, or if a site blocks Opera's VPN: Use OpenVPN with VPN Gate

File, Image and Video Downloader

Auto-crack and extract files that JDownloader can't

Alternative to JDownloader for downloading videos (with more custom options)

Create and Extract Password-Protected Archives like 7-Zip / RAR

Image Viewing

Video Playback

Show Media File Thumbnails in Thunar File Manager

Inspect Media Files

Duplicate File, Image or Video Finder

Files

Images

Videos

Screenshot Tool

Basic Image Editing

Serious Image Editing

Batch Convert Images (Excluding Animated GIFs)

Image Folder Thumbnail / Contact Sheet Creator

Screen Recording Tool

Basic Video Editing

Join or Merge Multiple Videos into One File (e.g. Compilation)

Add Subtitles or Audio Tracks to Video Without Reencoding

Serious Video Editing

Create Animated GIF from Video

Shrink Animated GIFs

Create 3D Art

Video Thumbnail / Contact Sheet Creator