A forensic image of the encrypted disk is useless (assuming strong passphrase, no bugs, etc.). The article is about the risk that an "evil maid" injects softwar

A forensic image of the encrypted disk is useless (assuming strong passphrase, no bugs, etc.). The article is about the risk that an "evil maid" injects software/firmware into his laptop that presents the expected UI but secretly logs everything he types, and does something bad with that information later.