Let's say they had your device for 15 minutes. Thats enough to disassemble and copy a bunch of data and reassemble. Unless you have whole drive encryption they

Let's say they had your device for 15 minutes. Thats enough to disassemble and copy a bunch of data and reassemble. Unless you have whole drive encryption they only need to copy the user folders (typically). Or your machine might have been in a queue and only looked at for 2 minutes. Or they might have not looked at it at all. Now pick a few different timeframes and you tell me how hard it is to know?