You're proposing a false dichotomy. The tactic might work, but how well it would work would depend on what other evidence was presented that you do have anothe

You're proposing a false dichotomy. The tactic might work, but how well it would work would depend on what other evidence was presented that you do have another encrypted area. For example, if they analyse the partition you gave them the key to and show that it hasn't been booted in 18 months; they cross-reference the cached DHCP leases with the times you were known to have been online using that machine and find discrepancies; they might even have secretly imaged your disk a month earlier and show that a large amount of supposedly free space has changed content in the meantime. (Maybe they even have you recorded telling someone that you have a second encrypted area on the machine.) If there's no such evidence, then it ought to be pretty hard to convict you.