He said he did this by inserting a flash drive given to the police department by a federal agency (I believe it was the NSA) and looking at what the flash drive came up with. I raised my hand and asked him what he did if the computer's owner had encrypted files and he said that it didn't matter. He specifically referenced TrueCrypt when he said, " Some people use encryption programs such as TrueCrypt to try to hide their files, but all it does is make the flash drive run a little longer."
So how can this work?
This guy doesn't know what he's talking about. In fact, I am rather horrified that this is his answer, because it's obviously false and/or reflects a pretty profound lack of knowledge. Or, he was being deliberately misleading, inferring that he would have access to a computer that had a CURRENTLY MOUNTED TrueCrypt. Most police departments go to ENORMOUS lengths to get at computers before they can be shut down. This can include doing things like using explosives to make an incursion as close to the computers as possible.
I have read about several cases where they got someone downloading child porn by coming in through the second-floor windows (presumably rappelling from the roof?) There was another case (in suburban Atlanta) where the FBI set explosives to tear through a living room wall in order to end up closer to running computers, and simultaneously lobbed flash grenades through the windows to prevent the suspect from being able to get to his computer to shut it down. This behaviour strongly indicates that they have no little magic flash disk with which they can crack TrueCrypt.
In fact, as far as I'm aware, The forensics toolkits that are "given out" to field agents are just search software that resembles EnCase, though I think the FBI has some custom stuff in there, most state/regional police do not and use standard Encase or even simpler tools.
Even the NSA can't crack Truecrypt, even though they might want criminals to think they can, to discourage its use. I've been involved in computer forensics (on the periphery) for awhile and I can tell you with some certainty that the best attack against TrueCrypt is a brute-force passphrase (permuted dictionary) attack.
It's slow and difficult and very seldom works, because people who bother with TrueCrypt also tend to have decent passwords.
In the field, agents simply do a cursory look for files. If they find nothing, they will shut the computer down, and cart it off to the forensics lab. In some areas, there is a huge backlog of computers waiting for detailed examination, sometimes as long as 3 months wait, because, frankly, the FBI is short on staff who are good with this stuff. They actually have ongoing trouble teaching field agents to identify when encryption is in place, because if it is, and they shut down the computer, they've likely destroyed all the evidence in the case (and this happens more than they would like to admit).
It was estimated not too long ago, that almost 50% of the FBI's technology resources are dedicated to finding child porn. They still sorta fail at it. It's a bit disheartening if you're a law-and-order sort.