Some people consider my lifestyle a little extreme, but really it's just well thought out. I find that a lot of things simply aren't discussed in communities despite potentially having value for a broader audience.
Something I've gotten into the habit of doing is wiping the LUKS header from devices I haven't used in a long time. There is really no good reason to keep it attached as I have virtually no use for those devices at this time and I can just as easily boot into a live distro and reattach it when I want.
Another thing I do is use scripts that change the start up process using initramfs on Debian or mkinitcpio on Arch. I remove the header from the main partition that uses FDE while I retain the header for the encrypted boot partition. When I boot up, I enter the boot partition decryption password and then it executes the necessary script.
First it asks me to plug in a designated USB drive, which I designate based on its UUID or model. The USB drive is itself encrypted, so it is decrypted after plugging it in. It contains the main partition's LUKS header, so the header on the drive is combined with the main partition and now it asks me for my password. After successful decryption my device boots up.
Once booted, the USB drive is virtually unmounted and no longer decrypted.
The next measure I have is a quick buskill script that watches that specific USB drive. I arm it and if it is now disconnected, my device automatically shuts off.
The LUKS header for the main partition is never stored on the disk ever.
Why go this length? Because even with key disclosure laws, it's virtually impossible to piece all this together from the standpoint of forensics. Even if you get the password, you don't have the header. The USB drive? Easy to break — especially if you remove the exterior. You have a proper 2FA process for your physical device, while the USB drive remains encrypted just in case. Using an SD card is another option. Anything that can host a LUKS header and is easy to destroy in an emergency.
It's surprisingly feasible and not that difficult to pull off. Once you have it in place, it's fully automated and nothing else has to be done. The only issue I ran into is when attempting to replicate it in Qubes OS, which definitely requires much more tinkering. If I remember correctly, it didn't come with the necessary modules to rebuild the image, which means you need to get them elsewhere and hope you aren't breaking anything mission critical.
It's useful to think through the actual process of different scenarios. For example, what would happen if you got raided right now? What information would the threat actors have access to? What about your online accounts? Which ones are connected to your real identity?
Simulating real scenarios is a great way to come up with proper workflows and countermeasures, which is something I find the privacy community rarely does. They rarely think about all the ways they could fuck up or get fucked over by their government. It's wise to operate from the perspective of having no time or only seconds. Similar to martial arts, it's about planning in advance and then building that instinctive muscle memory for when shit goes down.
Something else that people should do on a regular basis is examine any laptops, smartphones, external hard drives, and other storage devices. If the hard drives are old, no longer in use, and had sensitive data on them in the past, it's best to just open them up and destroy them, then toss them. You'd be surprised how many little storage devices you probably have lying around right now that either aren't encrypted, use weak passwords, or contained data that can still be recovered.
Maintain proper digital hygiene, both virtually and physically, and only retain what you are using. Everything else is just dead weight that can give you severe headaches in the future.
