This seems like something that would be difficult to do on a mobile device such as an iOS or Android, which trains the user not to think about the filesystem at all. Is there a user-friendly mobile solution for this?
One way of using the above would be to allow "logout" of the main user and login of an e.g. repair user, on logout the decryption key would be erased from memory, and this way the repair user has no access to my_butt.jpg . Actually Android already has the concept of multiple users, and each user has their own data storage, so the can open their own Facebook or Tinder and have the phone be loading their personal profile. Not sure about things stored on disk, though, and AFAIK if a user can be root then s/he can read all the files on the mounted encrypted disk.
So, the repair user would not have access to my_butt.jpg, but maybe they need access to an installed app? I guess 1 solution would be to have apps installed on a separate partition to data. Android has a system partition (I'm not familiar with iOS), so if the repair user just needs internal apps, that should be accessible from the system partition.
Full disk encryption is basically useless if the device is turned on/logged in.