It is possible to make a bootable, totally encrypted USB drive. By totally encrypted, I mean that the entire install of Ubuntu on the USN drive is encrypted. Not just the home directory folder of the USB install.
- a laptop with Ubuntu 16.04 installed on a hard drive and at least 2 USB ports.
- a previously created Ubuntu 16.04 Live! USB drive.
- a blank USB drive for the targeted encrypted Ubuntu install.
You can't create this using normal Ubuntu Live! install procedures. There is a
hardware trick you must do first: open the laptop, and physically remove the
internal hard drive, and set it aside.
Next, boot the laptop using the Ubuntu Live USB and with the blank USB in the other USB port. Choose "Install Ubuntu", not "Try Ubuntu" on the desktop.
Then go through the normal Install procedure - it will find the blank USB and
install a full encrypted version of Ubuntu on that USB. (Both disk encryption
and home directory encryption.)
The prior problem/issue was Ubuntu Live installs on your internal laptop
hard drive by default, which is not the desired result. By removing the internal hard drive, you force Ubuntu Live to do a full install on the only other disk it can find, which is your blank USB drive.