There was a case here in Germany where the police report revealed that they apparently spent a lot of time looking for evidence of a hidden partition/encrypted data etc because a PC owned by single man with zero evidence of porn was unusual. (but didn't find anything in the end, and didn't claim anything they didn't have evidence for)

this is why you should actually have "signs of life" and something _slightly_ illegal on your plausible deniability partition. Just enough dirt to get you into trouble, but not too much trouble. If you're squeeky clean, you get the rubber hose cryptography treatment.

Ah, the magical porn partition.

Level of kink up to you.

If you want those signs of life to be convincing, it should include all kinds of history without long gaps, such as:

- email, including recently received and sent emails

- web browser history

- system logs

- software updates

In practice, I think it’s impossible to do that. If the police discovers, for example, that your system logs show your machine was off for a week, but they also just saw you reset it, what do you tell them?

>>but they also just saw you reset it, what do you tell them?

That you're not a computer expert and have no idea why your computer wasn't keeping logs correctly?

not an expert, yet you set up an encrypted partition?

Yeah, there was a tutorial online. Thought it was a good idea in case my laptop got stolen. Don't need to be an expert to click through an automated wizard, do I?

"rubberhose him just to be sure"

this is a real problem, yes; i find encrypted volume in swap partition actually provides better plausible deniability. "I was told it should be 2x the size of RAM," - says a guy with 512G of ram and swapoff.