Tails OS Setup Guide (Step-By-Step)

Tails OS Setup Guide (Step-By-Step)

Here's the step-by-step setup for Tails OS, which includes the Tor Browser as its default and only browser.

What You Need

• A USB flash drive, 8GB minimum (16GB+ recommended)

• A second USB drive (or DVD) for the intermediary step if you don't already have Tails installed

• The computer you're installing from (Windows, macOS, or Linux)

• The target machine you'll boot Tails on

Step 1: Download and Verify Tails

Download the latest Tails .img file from:

https://tails.net/install/download/

Critical: Verify the download. This is not optional. Tails provides multiple verification methods:

On Windows — verify with Gpg4win:

gpg --verify tails-amd64-6.x.img.sig tails-amd64-6.x.img

On macOS/Linux — GPG directly:

bash

# Import the Tails signing key (one-time)
wget https://tails.net/tails-signing.key
gpg --import tails-signing.key

# Download image and signature
wget https://tails.net/tails/stable/tails-amd64-6.x/tails-amd64-6.x.img
wget https://tails.net/tails/stable/tails-amd64-6.x/tails-amd64-6.x.img.sig

# Verify
gpg --verify tails-amd64-6.x.img.sig tails-amd64-6.x.img

You should see Good signature from "Tails developers <tails@boum.org>" and the key fingerprint should be:

A490 D0F4 D311 A415 3E2B  B7CA DBB8 02B2 58AC D84F

If verification fails, do not proceed. Download from the official source only.

Simpler alternative — checksum verification:

bash

sha256sum tails-amd64-6.x.img
# Compare against the published checksum at https://tails.net/install/download/

Step 2: Flash Tails to USB

Option A: Using balenaEtcher (Windows/macOS/Linux)

1. Download balenaEtcher from https://etcher.balena.io/

2. Launch Etcher as administrator/root

3. Click Flash from file → select the Tails .img

4. Click Select target → choose your USB drive

5. Click Flash

6. Wait for completion and verification

   
   

This is the simplest method and works across all platforms.

Option B: Using Rufus (Windows)

1. Download Rufus from https://rufus.ie/

2. Select your USB drive under Device

3. Under Boot selection, choose Disk or ISO image and select the Tails .img

4. Click START

5. When prompted, choose Write in DD Image mode 

   (not ISO mode — Tails requires DD mode)

6. Confirm and wait

   
   

Option C: Using dd (Linux/macOS)

bash

# Find your USB device
lsblk
# Identify your USB — typically /dev/sdb or /dev/sdc
# DOUBLE CHECK this. Getting it wrong destroys the wrong drive.

# Unmount (macOS: diskutil unmountDisk /dev/diskX)
sudo umount /dev/sdX*

# Write the image
sudo dd if=tails-amd64-6.x.img of=/dev/sdX bs=16M status=progress

# Sync and you're done
sync

Replace /dev/sdX with your actual USB device (like /dev/sdb without a partition number, e.g., not /dev/sdb1).

Option D: Tails Installer (if you already have Tails)

If you already have Tails running on one USB, the built-in Tails Installer 

(Applications → Tails → Tails Installer) clones itself to a second USB for upgrades or fresh installs.

Step 3: Boot into Tails

1. Insert the USB into the target machine

2. Power on / restart

3. Interrupt the boot sequence (usually F2, F12, F10, DEL, or ESC — varies by manufacturer)

4. Enter the boot menu and select your USB drive (often listed as USB HDD, UEFI: [USB Brand], or Removable Devices)

5. If you get a black screen, try again and select the Tails (Troubleshooting Mode) option

   
   

BIOS/UEFI Configuration If It Fails

• Secure Boot: Tails supports Secure Boot on most machines. If boot fails, disable Secure Boot in BIOS.

• Boot Order: Ensure USB boot is enabled and prioritized above internal disk

• UEFI vs Legacy: Tails works with both. Try the non-UEFI option if UEFI boot fails

• Intel Macs: Hold the Option (⌥) key during boot to see the boot picker

Step 4: The Tails Greeter (First Screen)

After boot, you'll see the Tails Greeter. This is where you configure your session:

1. Language & Keyboard Layout — set appropriately for your region

2. Persistent Storage — on first boot, leave this alone. You can create persistent storage later if you need to save files across sessions (note: this weakens the amnesic property).

3. Additional Settings (click the "+" to expand):

   • Administration Password: Set a temporary sudo password if you need root access for this session (e.g., to install packages, connect to non-standard hardware). Without this, the root account is locked.

   • MAC Address Spoofing: Enabled by default. This randomizes your network interface MAC on every boot to prevent tracking.

   • Network Connection: Choose between:

     • Direct connection — straight Tor

     • Bridge / Tor is censored — use Tor bridges (obfs4) to hide the fact you're using Tor from your ISP

   • Offline Mode: disable networking entirely — useful for working on sensitive documents with no network exposure

4. Click Start Tails

Step 5: Tor Connection

After the desktop loads:

• If you chose Direct Connection, Tails automatically connects to Tor. The Tor Connection assistant appears — wait for the progress bar to complete.

• If you chose Bridge, you'll need to configure a bridge. Options:

  • Use a default bridge: built-in obfs4 bridges (simplest)

  • Request a bridge from torproject.org: solve a CAPTCHA, get a custom bridge

  • Enter a bridge you already know: paste a bridge address from a trusted source

    
    

A small onion icon in the top-right system tray turns green when connected.

Step 6: Using Tor Browser On Tails

Once connected:

1. Click Applications → Internet → Tor Browser (or the globe icon in the top bar)

2. Tor Browser launches with NoScript and uBlock Origin pre-installed

3. JavaScript is enabled by default but can be disabled via:

   • NoScript toolbar icon → block scripts

   • Tor Browser toolbar → Shield icon → Security Level → Safest (disables JavaScript entirely, disables some fonts, disables some image types)

     
     

Changing Security Level

This is crucial for darknet research:

1. Click the shield icon (🔰) next to the address bar

2. Click Advanced Security Settings

3. Choose:

Level	JavaScript	Web Fonts	Media	Best For
Standard	Allowed	Allowed	Allowed	Normal browsing, many sites break otherwise
Safer	Disabled on non-HTTPS, some features disabled	Limited	Click-to-play	Balance of usability and security
Safest	Disabled everywhere	Disabled	Disabled	Maximum security, many .onion sites work fine here

For darknet market research, Safest is recommended. Most .onion marketplaces are designed to function without JavaScript.

Step 7: Important Post-Boot Configuration

Verify Tor is working:

• Visit https://check.torproject.org in Tor Browser

• You should see: "Congratulations. This browser is configured to use Tor."

  
  

Unsafe Browser (know what this is):

Tails includes an Unsafe Browser (Applications → Internet → Unsafe Browser) that bypasses Tor entirely. This is for captive portals (hotel Wi-Fi login pages) only. Never use it for research — it exposes your real IP and deanonymizes you immediately. It has a bright red warning theme to prevent accidental use.

Clipboard and file sharing:

Tails isolates Tor Browser from the rest of the system. Files saved from Tor Browser go to the Tor Browser folder in your home directory, not the general Downloads folder.

Step 8: Setting Up Persistent Storage (Optional)

If you need to save bookmarks, PGP keys, or documents across reboots:

1. Applications → Tails → Persistent Storage

2. Enter a strong passphrase (this encrypts the persistent volume)

3. Choose which features to persist:

   • Personal Files — your /home/amnesia/Persistent/ folder

   • Network Connections — saved Wi-Fi passwords and VPN configs

   • Browser Bookmarks — Tor Browser bookmarks

   • Thunderbird — email client data

   • GnuPG — PGP keyring (critical for darknet comms)

   • Electrum Bitcoin Wallet — if needed

   • Printers — printer settings

   • Dotfiles — symlink any config files into your home directory

     
     

Security tradeoff: Persistence breaks the "amnesic" property. If the USB is seized, persistent data is only protected by your passphrase. Choose wisely.

Step 9: Shutdown Properly

• Applications → System Tools → System → Restart or Shut Down

• Tails overwrites RAM on shutdown to prevent cold-boot attacks. Wait for the "memory erasure" process to complete before removing the USB.

• On some systems, you'll see a completion message; on others, the screen goes blank.

Quick OPSEC Checklist for Tails OS

Done?	Item
☐	Verified the download with GPG or SHA256
☐	Booted from USB, not a VM (VM breaks anonymity model)
☐	Set Tor security to Safest for .onion research
☐	Never used Unsafe Browser during research session
☐	Used MAC spoofing (default — don't disable)
☐	No personal accounts logged in (Google, Apple ID, etc.)
☐	Documented the session timestamp and scope for legal records
☐	Properly shut down (RAM wipe completed)

One thing worth flagging: Tor Browser versions ship with Tails. The Tails team updates the Tor Browser bundle with each Tails release (roughly monthly). Keep your Tails USB updated — boot it, connect to Tor, and Applications → Tails → About Tails will prompt you for available updates.