The right way to do that is FDE, where you can't even mount the filesystem to see the files without having the decryption key.