I'd say for it to be practical, you'd need to know the rough time window (within seconds) that the device is doing cryptography within. For example, if it's got an encrypted bootloader, you can reliably expect it to start decrypting stuff shortly after power on.