To make it short, if you start your operating system in live mode, you are not writing anything on the system disk, but rather you are loading the entire operating system in the RAM. Everthing that you write on the system drive while in live mode gets erased upon rebooting.
The idea behind using live mode is that every forensic trace regarding the hidden encrypted volume that would normally be written into the system logs, kernel logs, and various other system files (that we would normally need to manually clean up after closing the hidden volume) will all be written into RAM instead of being written onto Disk, and then will all be completely erased upon rebooting the computer.
-As you'll see in this tutorial
+As you'll see in this tutorial, we can make use of a VM's live mode to securely erase every trace of sensitive activity.