The basic GNU/Debian Live does the job, but don't prevent from requested access to connected hardware.
Many Debian based live system, like Ubuntu or Backtrack do this in same way:
- Run live system using only ram, cpu and networks connections.
- Give the ability to mount accessible partitions... or not.
- Give the ability to scan present hardware in read-only mode for making discrete copy of whole hard drive, for sample.
Because I'm Debian user and prefer Debian stability than Ubuntu's modernity, I use Debian live. With the
Debian Live Helper, who let me create my own Debian Live, with all forensic tools as a simple build option... Upto date, effectively. (If I run LiveHelper now, all packages are from today's debian repositories).
Nota If there is one useable linux swap partition present on hardrive and system don't have lot memory (less than 512Mo), some versions of Live systems may try to use them even without user confirmation! This could break an hibernation state!!
If current installed OS is not Linux, you could be quiet.