Booting 'live' form the hard disk

Question

I use VeraCrypt for file-container level encryption for all of my files.

But being very paranoid, I am always worried about the OS¹, Primary applications and non-primary applications leaking the data.²

I am also tired of cleaning thumbnails, cache files among other things before shutting down my machine.

A good solution to all of this(to prevent the leakages mentioned above) would be to boot into a live OS from a USB. I can do all of my work, change any of the system's files/configurations, let the OS do any thumbnail creation/cache files generation and then save all of my files in some encrypted persistent storage(on the same device or another).

In that case I would not have to bother about the above leakages because when I will shut down the machine, the entire OS would return to its "virgin" "pritstine" state, with no (software-level)evidence of its existence a few moments ago.³

While this is a good solution, it isn't great, because now I have to carry an additional piece of hardware with me(other than the laptop itself) and (most importantly) the overall speed/snappiness of the system is decreased many folds.

What I want to do is to boot the entire OS from the hard disk itself, but while preserving all of the characteristics of a live OS. That is: The hard disk should behave just as a source for the OS(as it is in the case of booting from a USB), running everything in RAM only, not writing any single bit of data onto the hard disk[it will still have an encrypted persistent storage(preferably on some other partition), but writing data onto it would solely be on my will] and returning back to the exact same virgin state on shutdown.

---

Any way of also saving limited system settings and some app settings in the encrypted persistent storage would be welcome, but it is not something which I am specifically asking for.

---

Footnotes:

¹If required prefer the GNU/Linux OS.(any distro)

² Though the article is dealing with Deniable File Systems, the things mentioned there are also valid for normal file systems(as mentioned there too).

³ "few moments" defined as the time interval after shutting down a machine in which a cold boot attack is posssible.

---

Other Notes:

-Threat model: though I don't know the exact job description, my adversary includes a 'software engineer' capable of sophisticated "software based" attacks. Though he has physical access, physical attack capability is mostly limited to BIOS flashing only, no kind of forensic analysis.

-please ignore sub-OS malware (e.g. BIOS, NIC, etc.)

-Full disk encryption solves the leakage problem mentioned above, but it is like allowing a devil to wander into the wild and then controlling it, but I don't want to even create the devil in the first place.

Answer 1

With GNU/Linux, this should be possible simply by mounting the / file system read-only and adding tmpfs file systems (that saves the data on RAM) for /var/log etc. that needs to be writable.

There are some caveats with this approach, though:

• Any process with root privileges might mount the file system as read/write. An optical medium solves this, as it's read-only by nature. I don't know whether e.g. such SSD drives exists that have physical switches for making them read-only. Maybe there's simply not enough demand for them.
• You would have to occasionally upgrade the whole image in order to get security updates. Otherwise this approach will produce more security issues that it solves.

For these reasons, I'd suggest full disk encryption for the OS drive, if it's suitable for addressing your current risk models.