I'm not saying this is what happened, (and from what I've read, it's as absurd as you think). However, an expert could hypothetically have all sorts of clue ab

I'm not saying this is what happened, (and from what I've read, it's as absurd as you think). However, an expert could hypothetically have all sorts of clue about the contents of an encrypted drive. Keep in mind that encrypted files still probably have a "last modified date" maintained by the OS, and that many viewer/player apps keep a timestamped list of recent files. If they see that realplayer claims to have played "nude_12_year_old.avi" on a "z:\" drive on a certain date, and that an encryption app opened an encrypted file a little while before that.... You can't know, but an expert could, hypothetically, make an educated guess. Again, not saying that's what the expert did here. Just saying that this sort of conclusion is theoretically possible in some cases.