iirc there was an article few days ago about tools to detect trucrypt encryption types in use. The article mentioned the presence of some files cached by OSes,

iirc there was an article few days ago about tools to detect trucrypt encryption types in use. The article mentioned the presence of some files cached by OSes, sometimes disclosing the presence, the type or even part of the content of TC volumes. Personally that is the most scaring part, having cached data leftover in the system, which is much more indicative than some pseudorandomness of TC strings.