> O have a file catted from /dev/random that looks like a it could be TrueCrypt partition, good luck trying to convince them it is not an encrypted file.

That's a mistake unlikely to be made; partly because the vast majority of seized computers run Windows :P but mostly because it is fairly obvious.