Then you have gotten your hands very much dirtier than necessary. A good attack should not put you at such risk.

Coming up with real fake evidence is a lot harder than just coming up with a random blob that the cops think is evidence the suspect is hiding.

E.g. are you really able to carefully craft a filesystem image that you're sure has no metadata that proves the innocence of the suspect?

Eh, not so hard. Proxy their internet for a browsing session, and you put thumbnails of images in their cache. If they have any encrypted drive, or any encrypted blobs (could push those into their cache as well), and they're not going to have a great day.

Cached images has been enough to put away more than a few folks - there was also recently a story about using exactly that tactic against a suspected spy.

This is really moving the goalpost from the grandparent's comment of "encrypt a zip drive with drivel, toss it in his car and call the cops".

Yes of course you can get an active MiTM session going you can do a lot of shady stuff.

It can easily be used in tandem with the encrypted drive, to create probable cause to suspect the drive.

And MiTM is far too simple to do. One of my friends was able to rickroll many a person with about $100 of gear. It was always troubling to watch my computer connect to my home network while at a conference, with no real notification to me.

This also tends to require that you look at CP in some way. I'll pass on that...

A woman tried that on her ex-husband, got caught, and went to jail. Read the related note here:

http://blogs.harvard.edu/philg/2016/05/14/what-if-youre-in-p...

Why go through the trouble to find kiddie porn when you can just cat /dev/urandom?

But then the detention won't be indefinite.