If you want protection from someone booting up your computer in single/rescue mode to read/modify files you'd have to encrypt the entire disk (using LUKS, for example).