[handedness]

Anti-forensics just isn't a focus of the Qubes OS project. Beyond a typical LUKS/dm-crypt FDE implementation, there isn't much else in the way of protections. There have been some community efforts around it to make some relatively minor enhancements.

Once you've decrypted the disk, the contents of every permanent Qube is there for the taking, and it would be up to the user to further secure any data within specific Qubes if they desired any protection beyond what they get via FDE. Something like encrypted containers, for example, which isn't specific to Qubes (and has its own limitations).

In terms of running processes, Qubes OS benefits greatly from Xen's isolation between Qubes, but from a data forensics standpoint a recent Pixel running GrapheneOS has massively stronger (and more numerous) layers of protection against data extraction, and at all levels (I/O, memory, disk, etc.).

[ktallett]

You can use a disposable Qube every time.

[handedness]

Disposable Qubes are not intended to be robustly anti-forensic in nature. Implementing robust anti-forensic measures in stateful hardware requires far more from the hardware layer than is on offer.

There have been and are some community efforts towards mitigations, but nothing remotely approaching what three (soon to be four) specific phone architectures provide.

Qubes OS is many wonderful things, but it is not particularly anti-forensic. If anti-forensics on PC hardware is the primary intention behind disposable VMs, there are better options.