It puts just out "hello", but if I make a input it's print just the first letter of the array.
But if I use instead *_string as an array with a fieldmarker (_string[bla]) I can read out
the complete input getting from the serial cache.
What is the difference between the char array I'd allocate at startup and that ones, that's read out over serial?
I mean, there is a difference between the string I set up on top and that one I create out of the serial input.
Serial.println(*_string) is used, because I want to print every field of the array separately.
I think the problem is you are assuming that when you hit enter in the serial monitor, Serial.available() instantly returns however many bytes you sent it. Serial communication is slow compared to how quickly your loop() runs. loop() will run hundreds to thousands of times between when it receives a byte, so it's unlikely that Serial.available() will ever return anything greater than 1. To combat that, you need a terminating character that tells your code "ok, i'm done sending Serial information for now" such as a new line or carriage return. When you receive that, you can start doing things with the full string.
strtok has its own, private static buffer, so it is quite legal to return a pointer to it.
In the other case, the function is returning a pointer to an automatic variable allocated on the stack which will go out of scope as soon as the function returns.