Live USB changed files

Question

I run Ubuntu live USB in Try Me mode. How to get all changed files and settings?

Example: I boot live USB. I change light mode to dark mode. How to know what file is changed? I want to make own live USB with dark mode default.

Answer 1

When you make the live boot USB, if you use a tool like mkusb, it will offer you the option to add "persistence", so some changes may be keep between boots (like wireless settings). This "persistence" location may be a file (formerly named "casper-rw" but now named "writable") or a partition (with the label "casper-rw"). The filesystem used for writable is ext4 (without journaling) so may be of any size, However, if writable is placed in a FAT filesystem (like the USB has, it's size is limited to 4GB. If you set up your live boot from an ISO sitting on an ext4 filesystem, you can have writable on another partition -- HOWEVER, last time I looked (years ago), the grub boot stanza, while it allowed a "persist-path", that did not include a disk/partition identifier, just a path like "/X", and the partition had to be FAT for /X to be found. writable will contain the changes made to your ISO, but not all such changes are meaningful. You might add a new kernel to writable, but since casper/writable is a hook to initrd, the (default) kernel has already been loaded, and new kernels in writable will be ignored.

The writable file may be mounted with the loop option (and read-only(ro) used below:

sudo mount -oro,loop -text4 /mnt/n1p9/X/writable /mnt/lb

n1p9 is a FAT partition, containing some directories (X, Y, ...) for writable files. Changed file appear in a directory /mnt/lb/... which mirrors the root dir. You may just copy them where you wish.

The command to make an empty 4GB writable is:

mkfs.ext4 -F -N 40000 -O^has_journal -L casper-rw writable

The grub stanza I added to /etc/grub.d/40_custom is:

menuentry "Ubuntu 24.04 ISO " {
    rmmod tpm
    # bootiso is a link to an ISO in a directory on an ext4 partition.
    # A link lets you change the ISO without needing to change this file.
    # The path is relative to the partition, not wherever it may later be mounted.
    #rmmod tpm
    set isofile="/bootiso"
    # Change the disk and partition to identify where the ISO is located.
    set diskpart="(hd0,7)"
    # On a FAT32 partition, you may have a persistent file for some system changes -- uncomment if wanted.
    # Disk identifiers seem to be ignored to identify the FAT32 partition with the persistence file.
    # Use a unique path for the persistence file. Sadly, seems you cannot use an ext4
    # filesystem for the persistent file.  Keyword order of "persistent persistent-path" is critical.
    # tried (hd0,9)/X too, failed.
    set persist="persistent persistent-path=/X"
    loopback loop ${diskpart}$isofile
    #  persistent casper-rw file must be on a FAT partition to be seen.
    # and as of 3/23/2015, using both persistent and toram still cannot shutdown cleanly.
    # leaving casper-rw unclean, but working.
    linux (loop)/casper/vmlinuz boot=casper layerfs-path=minimal.standard.live.squashfs iso-scan/filename=$isofile $persist
    initrd (loop)/casper/initrd
}
### END /etc/grub.d/40_custom ###

Answer 2

Setting up persistence not required. Using df you see /run/live/overlay where all temporary changes reside. For example, /run/live/overlay/rw/home/user/.config/dconf/user is where all the user dconf changes are.