Comment by kennysoona

My approach is to have a hidden OS. Either via a hidden bootmenu, or better yet transparently boot into a virtualized guest by default. With secure boot and encryption, things can be made hard for anyone to actually examine the drive out of the limited context provided. Requests for more access can be met with confusion and feigning technical ignorance.