I use VeraCrypt for file-container level encryption for all of my files.
But being very paranoid, I am always worried about the OS1, Primary applications and non-primary applications leaking the data.2
I am also tired of cleaning thumbnails, cache files among other things before shutting down my machine.
A good solution to all of this(to prevent the leakages mentioned above) would be to boot into a live OS from a USB. I can do all of my work, change any of the system's files/configurations, let the OS do any thumbnail creation/cache files generation and then save all of my files in some encrypted persistent storage(on the same device or another).
In that case I would not have to bother about the above leakages because when I will shut down the machine, the entire OS would return to its "virgin" "pritstine" state, with no (software-level)evidence of its existence a few moments ago.3
While this is a good solution, it isn't great, because now I have to carry an additional piece of hardware with me(other than the laptop itself) and (most importantly) the overall speed/snappiness of the system is decreased many folds.
What I want to do is to boot the entire OS from the hard disk itself, but while preserving all of the characteristics of a live OS. That is: The hard disk should behave just as a source for the OS(as it is in the case of booting from a USB), running everything in RAM only, not writing any single bit of data onto the hard disk[it will still have an encrypted persistent storage(preferably on some other partition), but writing data onto it would solely be on my will] and returning back to the exact same virgin state on shutdown.
Any way of also saving limited system settings and some app settings in the encrypted persistent storage would be welcome, but it is not something which I am specifically asking for.
1If required prefer the GNU/Linux OS.(any distro)
2 Though the article is dealing with Deniable File Systems, the things mentioned there are also valid for normal file systems(as mentioned there too).
3 "few moments" defined as the time interval after shutting down a machine in which a cold boot attack is posssible.
-Threat model: though I don't know the exact job description, my adversary includes a 'software engineer' capable of sophisticated "software based" attacks. Though he has physical access, physical attack capability is mostly limited to BIOS flashing only, no kind of forensic analysis.
-please ignore sub-OS malware (e.g. BIOS, NIC, etc.)
-Full disk encryption solves the leakage problem mentioned above, but it is like allowing a devil to wander into the wild and then controlling it, but I don't want to even create the devil in the first place.