Why rely on the (possibly compromised) OS of the host computer's hard drive when you can boot your own OS straight from the USB itself? What you are looking for is tails (https://tails.boum.org/) with a luks encrypted persistent partition.