Whole disk encryption should really be standard. No point deleting data if it's encrypted. At that point it's more clear-cut in becoming whether you surrender a key or not, no gray zones.

> easily detect hidden partitions.

Even hidden volumes in encrypted partitions? Has that feature of VeraCrypt been cracked?

https://www.veracrypt.fr/en/Hidden%20Volume.html

It's a big bunch of random noise. Of course it's trivially easy to see the drive image is not like other drive images, which is all they're looking for. Go to jail until you hand over the passphrase.

Hidden volumes, though, enable you to place what theoretically appears to be a big bunch of random noise (unless you know the key) in an even bigger bunch of random noise with a legitimate, demonstrable purpose (an encrypted volume.)

Would you seriously attempt to convince US government agents that your 512 GB hard drive contains only a 256 GB filesystem because you're a random noise enthusiast?

It looks like there's 512GB of space committed, but contains less than 256GB of content. There is no protection against the hidden volume being overwritten, if the content in the explicit volume grows too large.

They dont use tools. For inspection of random phones from non-suspects they just poke around by hand. Only when they find something do they employ actual tools.

Do you have a source on this? Preferably one that will be updated if the policy and practices change?

The only safe assumption is the worst case.

Why would they do this rather than simply image the device? How do you know what their protocol is?

Because opening a phone and looking at the first few texts/emails is faster than imaging. One cannot take a phone and properly image it in the 5-10 minutes they spend with the average phone.

10 minutes is more then enough time to image most devices. Various groups have had stuff like this around for quite a while now. http://www.thenewspaper.com/news/34/3458.asp