When I run the live image (Ubuntu 18.04), it shows the root filesystem being an overlay with the squashfs image (/cdrom/casper/filesystem.squashfs, containing the main data) as lower layer, and /cow/upper as upper layer. But /cow is not visible anymore as it is hidden by the overlay mounted on root.
Where (on what device) does the upper layer live? Is it accessible somewhere or is it a memory-only device?
COW stands for copy-on-write, In the case of live media it refers to the changes that are made to the live environment. It is accessible if you boot live iso in persistence mode, in that case it is written to the drive, folder or casper-rw container file you specify. But if persistence mode is not enabled it is just a memory only device.
There are many articles available on askubuntu regarding persistence.
You can mount casper-rw file and access contents within using:
sudo mkdir /media/casper
sudo mount -o loop casper-rw /media/casper/
