I understand that in some countries, electronic devices can be searched at customs and border check points. I would like to understand how this check is done technically.
I.e., do they just turn it on, just for my password, type it in and then browse around? Or do they connect (how? USB?) a storage device with a program that scans the hard drive (file system? sectors?) for things they search for?
Also, what are they searching for, and how? Text? Images? Documents? Do they have a list of known fingerprints, hashes, file names? Or is it heuristics (jpg with lots of skin tone => child pornography?). Do they also copy stuff off in this manner, or do they disassemble the laptop and put the disk in a clone devices?
What operating systems and file systems are they prepared for? E.g., would XFS on a loop device on EXT4 stump them completely?
What are their means of detecting hidden, encrypted and/or steganographised volumes, vaults, partitions or file contents (e.g. steganography in a bitmap)? Are they prepared for common solutions (TrueCrypt, luks etc.) only, or do they employ methods to detect other custom solutions (analysing bit patterns in unused sectors, signal-to-noise ratio in pictures etc.)?
Countries I'm looking at are US and UK.
(Lots of questions, I know. Blame my curiosity.)