PH4NTXM · Adaptive Identity Live OS

A SESSIONWITHOUT A PAST.

PH4NTXM is a Linux Live Operating System with an embedded Adaptive Identity Engine. Every boot creates a new, disposable session based on your selected mode.

The engine builds one linked identity from a new random seed. Computer name, MAC addresses and reported processor, memory, graphics and screen details follow that identity. Browser and network settings use the same session values and selected mode to keep the profile consistent.

Before the desktop opens, choose a password for administrator actions and screen unlock. You can also set a separate emergency password to trigger Panic/Nuke at screen unlock.

The session is used once and is never saved for reuse. At shutdown, Nuke blocks networking and closes the live user’s programs. The running system first scrubs available RAM. A separate Nuke kernel then runs memory-test patterns, followed by a second scrub of available RAM before powering off.

Explore the system Build from source

Debian / XFCE 64-bit system Amnesic live session GPLv3

PH4NTXM BOOT PILOTINTERACTIVE DEMO

PROTECTEDall primary chains active

MODE LINUX

Explore a protection layer above.

LINUX PROFILE

A Linux-aligned identity with Firefox ESR and protected direct connections.

NETWORK OPEN

Demo only — your connection is unchanged.

01 / Architecture

One boot.
One linked identity.

Shared session values link supported hardware reports with the browser and network profile. Memory, time, and readiness checks operate alongside that identity throughout the live session.

MODE

Selected at boot and fixed for the session.

IDENTITY

Session identity and device details.

HARDWARE

System, graphics, memory, and screen profile.

NETWORK

Network identity, packet transformation, and routing.

SESSION

Browser, time, system checks, and shutdown.

SYSTEM_LIFECYCLE

Boot → Identity → Enforcement → Operation → Nuke → Termination

CHAIN LOCKED

02 / Boot modes

Three modes.
Selected at boot.

You choose LINUX, WINDOWS, or LONE WOLF from the boot menu. The selected mode stays fixed until the session ends.

MODE / 01

LINUX

Linux-aligned identity for the system, browser, and network.

Linux hardware and identity profile
Encrypted domain name requests
Protected traffic before it leaves

MODE / 02

WINDOWS

Windows-aligned identity built from the same linked session values.

Windows-aligned network behavior
Matching browser and hardware profile
Protected traffic before it leaves

MODE / 03

LONE WOLF

Independent Linux-aligned identity with Tor Browser and Tor routing for supported TCP connections.

Tor Browser and Tor-routed connections
Domain name requests go through Tor
Internet stays blocked if Tor fails

03 / Main features

From boot to shutdown.
A clear session workflow.

Check your session, browse or open files in isolation, export encrypted vaults, review devices or connections, and set optional emergency triggers. All tools are available in both editions and every boot mode.

Boot & Session

Start in RAM, establish the session identity, then check readiness.

Live systemRUNS IN RAM

BOOT FROM USB. WORK FROM RAM.

The live system loads into RAM. Once loading is complete, you can remove the boot USB and keep working. The next boot starts a new session.

Identity engineONE SESSION

LINKED IDENTITY

System identity, supported hardware reports, browser settings, and network behavior share a linked profile. Newly connected network adapters receive a protected identity before use.

Hardware reportsPROFILE-ALIGNED

CONSISTENT SYSTEM REPORTS

Supported system tools report processor, memory, and device details from the session profile. Familiar commands keep their normal output and options.

Network protectionBLOCKS ON FAILURE

PACKET TRANSFORMATION + FIREWALL

Linux and Windows combine packet transformation, firewall protection, and checks at the network exit to prevent traffic from bypassing protection.

Domain namesPROTECTED

ENCRYPTED DOMAIN REQUESTS

Linux and Windows encrypt domain name requests. Lone Wolf sends them only through Tor.

Live sessionDISPOSABLE

MEMORY + TIME

Memory noise, time changes, and generated system values exist only for the active live session.

Session accessYOUR PASSWORD

SESSION PASSWORD

Set your own password before the desktop opens. Use it for administrator actions and to unlock the screen. Each new boot asks you to set one again.

System stateSESSION STATUS

PILOT + HEALTH

Boot Pilot checks readiness, connects to Wi-Fi, and opens your browser. Health adds detailed reports and an on-demand Browser Check for Firefox or Tor Browser.

Browsing & Files

Browse, inspect files in isolation and export the results you choose.

BrowserMODE-ALIGNED

FIREFOX + TOR BROWSER

Linux and Windows use Firefox ESR with the session profile. Lone Wolf uses an isolated Tor Browser connected through system Tor.

Browser isolationOPTIONAL

BROWSER AIRLOCK

Open Firefox or Tor Browser in an isolated workspace. Import selected files, keep downloads in private RAM, and export chosen results after stopping the browser.

DocumentsOFFLINE CONVERSION

DOCUMENT AIRLOCK

Convert supported documents and images into an image-only PDF inside an offline disposable virtual machine. Unlock supported encrypted documents there, then review the pages before export.

ArchivesOFFLINE INSPECTION

ARCHIVE AIRLOCK

Inspect ZIP, RAR, 7z, and TAR archives in an offline disposable virtual machine. Open selected files through isolated viewers, with password prompts for encrypted ZIP entries.

Local mediaNO NETWORK

ISOLATED MEDIA VIEWERS

View local images and play audio or video in isolated viewers without network access. Files open read-only, and temporary viewer data is removed when you close them.

Encrypted filesMANUAL EXPORT

VAULT

Keep selected files in private RAM and export an encrypted .ph4vault copy with a separate password. Unlock it manually in a later session, without saving the operating system session.

Monitoring & Control

Review activity, enable optional guards and control network access.

Session monitoringOPTIONAL

SESSION GUARD

Check generated identity consistency and protection readiness every 10 seconds. Review detected failures and monitored MAC changes. You choose whether to enable Lockdown.

Inspection toolsON DEMAND

OPSEC SUITE

Shared GTK tools inspect networks, the kernel, processes, and radios. ConnWatch tracks incoming TCP attempts. Shredder handles selected files, with confirmation before deletion.

USB approvalOPTIONAL

USB GUARD

Preserve existing USB connections and block new or reconnected devices pending approval. Enable protection when needed. Each approval requires your session password.

Application accessOPTIONAL

NET GUARD

Require approval for each live-user process execution before outbound IP access. Approved traffic still follows your mode’s firewall, packet transformation or Tor path.

Clipboard hygieneOPTIONAL

CLIPBOARD GUARD

Automatically clear copied content after a chosen timeout, with optional coverage for middle-click selections. Each new copy starts a fresh timer. No clipboard history is kept.

Network controlSESSION OPEN

LOCKDOWN

Cut network access while keeping the live session open. Your applications and local work remain available.

Emergency & Shutdown

Prepare optional emergency triggers and end the session through Panic/Nuke.

Emergency accessSCREEN UNLOCK

EMERGENCY NUKE PASSWORD

Set an optional, separate emergency password during session setup. Enter it at screen unlock to immediately request Panic/Nuke without confirmation. Your normal password still unlocks the session.

Timed responseSILENT TIMER

DEAD MAN’S SWITCH

Arm a silent countdown for automatic Panic/Nuke at expiry. Arm, Renew, and Disarm require your session password. Closing the controls or locking the screen keeps the timer running.

TerminationSESSION END

PANIC + NUKE

Panic ends the session through Nuke. Armed USB storage removal uses the same cleanup path, which also runs during normal shutdown.

04 / Failure policy

If protection is not ready, traffic stays blocked.

Network access waits for the selected mode’s required protection checks. Your browser opens from Boot Pilot only after readiness is checked again.

LINUX / WINDOWS: no packet transformation → DROP
LONE WOLF: no Tor connection → DROP

IDENTITYREADY

FIREWALLREADY

TRAFFIC PATHREADY

NAME LOOKUPREADY

BYPASSDENIED

PH4NTXM Abyss / XFCE live environmentOperational state remains local to the session

Two editions. One system. Abyss and Ghost share the same tools, protection settings and three boot modes. Both keep rounded windows, subtle transparency, and soft background blur. The buttons above preview each look. Choose your ISO edition at build time. Choose your build ↗

05 / Nuke Kernel

Different triggers.
One shutdown path.

Normal shutdown and every Panic trigger converge on the same Nuke path. Explore the sequence from network isolation to final cleanup and poweroff.

Read Nuke documentation ↗

Normal shutdown, manual Panic, an emergency screen-unlock password, an expired Dead Man’s Switch and matching armed USB removal share the Nuke termination path. Enable JavaScript to explore the interactive preview.

WHAT PH4NTXM DOES NOT CLAIM

PH4NTXM reduces session-linking signals and blocks accidental network fallback. It cannot protect a compromised machine, compromised firmware, operator mistakes, physical side channels, or every forensic method. RAM and file overwrite remain best effort.

Read the threat model ↗

06 / First boot

Before your
first boot.

Hardware, workspace and build essentials. Prepare your machine, choose your edition and start a fresh session.

01What hardware should I prepare?

PROCESSOR: 64-bit Intel or AMD processor (amd64).
BOOT MEDIA: A USB drive sized for your generated ISO. Boot directly on your physical computer.
MEMORY: RAM holds the live image, running applications and private workspaces. Plan capacity around the ISO size and your workload. Airlock tools check available physical memory before launch.

02Which tools use hardware virtualization?

Document Airlock, Archive Airlock and opening or reviewing existing Vaults use KVM guests. Enable Intel VT-x or AMD-V in firmware and provide KVM access in the live session.

Browser Airlock and App Airlock use process isolation. Vault creation and encrypted export run directly in the live session.

03How do I keep files for my next session?

Each boot creates a fresh live session with its working data in RAM. Save or export selected files to external storage before shutdown.

Vault exports encrypted .ph4vault copies that you can open manually in a later session with your vault password.

04Where do I start?

VERIFY: Verify your selected source revision using the distribution guide.
BUILD: Use an amd64 Linux host with current live-build, debootstrap and Python 3, plus root access and internet connectivity. The image targets Debian 13 trixie. Choose Abyss or Ghost. Both editions include the same tools and boot modes.
BOOT: Verify the ISO checksum, prepare your USB and choose Linux, Windows or Lone Wolf at boot. Set your session password, then follow Boot Pilot through readiness checks.

Verification guide ↗Build & boot guide ↗

07 / Open source

Inspect it.
Audit it. Build it.

PH4NTXM is open-source under GNU GPL v3. Build your own amd64 ISO with live-build, then boot from USB directly on your computer. Audits, tests, and patches are welcome.

Open repository Contact

Build guide ↗Verify the source ↗Documentation ↗

BASEDEBIAN / XFCE

SYSTEM64-BIT AMD / INTEL

SESSIONLIVE / DISPOSABLE

DELIVERYSOURCE ONLY / NO PREBUILT ISO

LICENSEGNU GPL v3.0

ENCRYPTION KEYPUBLIC KEY ↗