The advantage of doing this at the filesystem level is that you don't need to modify every piece of existing software which writes sensitive data (video/images/

The advantage of doing this at the filesystem level is that you don't need to modify every piece of existing software which writes sensitive data (video/images/logs/etc.). I'm thinking of an EncFS type stackable solution (as suggested by @robryk) based on FUSE because you could copy the encrypted files from the upper level filesystem when needed (without remounting the lower level filesystem in read-write mode) and examine them on an air-gapped computer which holds the private key. The disadvantage of this type of stacked solution is that it wouldn't be possible to implement plausible deniability.