SecureInit is a well-thought-out program that can lock files and folders, make the System Folder invisible, erase files not on its user-specified approved list, lock disks after use, refresh
(replace) specified files with clean copies after use, and password-protect everything. It can also purge files as a disk fills up, but this feature is too dangerous to use in most cases. SecureInit is particularly good at resisting efforts to bypass it.