I’ve refined the script for deleting logs and metadata and studied how metadata works in dom0. Script now mounts these directories: /var/log , /etc/lvm/archive , /etc/lvm/backup , and /var/lib/qubes/backup into tmpfs (why I previously had issues with this is unknown - perhaps I did it during an active session or had applied some additional mounts beforehand). Mounting directories from /home/user/.local/share is pointless - it would only break appmenu, since we’d merely be removing empty directories from /home/user/.local/share/qubes-appmenus/ (Qubes doesn’t create metadata in this directory for disp-vms). Achieving 100% anti-forensics is impossible, as these two directories write metadata to disk: /etc/libvirt/libxl, /var/lib/qubes and mounting them into tmpfs would break Qubes. Therefore, for 100% anti-forensics, you need to follow this guide and run the entire dom0 on an overlay / zram-disk.