Files are being indexed from the hard drive, even in forensic mode.

I was wondering if I could get suggestions for tools to see/possibly stop or limit what processes are accessing the drive. Top is good mostly for CPU activity, and I'm going to try htop in a moment. I'm pretty sure I had to disable tracker-store and tracker-miner-fs, which I thought was odd for a mode that's not supposed to touch internal hard drives. That may be a fstab problem?

I'm running a live USB with persistence, if that helps. The boot params DO include "noautomount" and "noswap". Right now, I've "persistence" placed in front of those two, and the drive hasn't been touched yet. YET! haha Before, "persistence" came last every time.