If you boot Knoppix with cheatcode "noimage" you can only see persistent memory in the (compressed) file '/mnt-system/KNOPPIX/knoppix-data.img'. If you boot without this cheatcode you can also see the persistent memory in the (decompressed) directory '/KNOPPIX-DATA/'.

In "case 1" from you, all is done by Knoppix.

You can change personal settings in '/home/knoppix/' or '/root/', you can install or deinstall programs in '/usr/' and the program-settings in '/etc/'. But in reality Knoppix writes all this stuff in '/KNOPPIX-DATA/' using "UNIONFS".

To prevent later trouble you can do a backup (your "update.tar.gz") from your personal stuff, which is a part of 'KNOPPIX-DATA/', and leave out the remaining of '/KNOPIX-DATA/'.

In "case 2" you can
a) only delete persistent memory alone, or
b) reformat the whole USB flash-drive and reinstall Knoppix. But why this expenditure?