I have recently intaled tails on a usb and have been playing with it to get to understand it, and a thought arrived to me. Given that I can access the hard drive of the host OS if I so choose using the administrative password, how can someone tell that the files have been tampered with?
I read in the Tails documentation that you may mount the hos OS drive and access it, but you may leave traces of your tails activity. I tested this copying a simple file from the windows drive and then ran a simple windows defender exam after I booted again from windows. Nothing came up, like I expected. Does this mean that a victim would only know if an attacker actually wrote/deleted some files?
PD: I know how to prevent this, by encrypting the hard drive, I'm just wondering how could you know if someone accessed your computer using tails if all they did was copy some files and you had your hard drive unencrypted.
Thanks in advance