I&#x27;m not saying this is what happened, (and from what I&#x27;ve read, it&#x27;s as absurd as you think).<p>However, an expert could hypothetically have all sorts of clue about the contents of an encrypted drive.  Keep in mind that encrypted files still probably have a &quot;last modified date&quot; maintained by the OS, and that many viewer&#x2F;player apps keep a timestamped list of recent files.  If they see that realplayer claims to have played &quot;nude_12_year_old.avi&quot; on a &quot;z:\&quot; drive on a certain date, and that an encryption app opened an encrypted file a little while before that....   You can&#x27;t <i>know</i>, but an expert could, hypothetically, make an educated guess.<p>Again, not saying that&#x27;s what the expert did here.  Just saying that this sort of conclusion is theoretically possible in some cases.