You can make your life easier by using a union mount using aufs or unionfs-fuse. Basically, you make one FS (U) out of several ones that are /unioned/ together. In your case, 2 FS, one read-only (like a on a cloop or compressed btrfs on your usb tick (R) ) and one writable in RAM (tmpfs typically) (W). When you write on U, it create a file on W and writes to it. When you read from U, it reads from R unless the file was created on W.