At best a virtual rncrypted disk on the unencrypted drive.
If you (not you OP) are doing that secretive work, maybe you shouldnt do that on this OS and instead on Tails or other temporary distros