I assume he had to give up the decryption credentials when he handed the laptop for the investigation. Not complying with the investigation can make it worse for you in some places.
In a country where possession of chewing gum is illegal and 14 grams of heroin geets you a death sentence, I'm not sure I'd want to test the practical limitations of the burden of proof on that sort of thing.
Some legal systems permit inference of guilt ("spoliation inference") based on attempts to destroy evidence; you might wind up with just extra convictions this way.
Intent: thinking through this from a problem-solving perspective. Don't do this crap, kids, lest ye end up in prison or worse.
Or at least do a full wipe (including backups) and reinstall. "Here's my FDE key, but I erased everything after I left that place and I don't have their stuff anymore."
Well, the file was found on his laptop and laptops are pretty much exclusively using SSDs. On SSDs a simple `rm` is enough. On an SSD:
1. You run rm
2. Your filesystem uses trim to mark the pages as invalid
3. The drive's garbage collector finds blocks containing invalid pages and consolidates valid pages into new blocks and marks the old blocks as invalid.
4. Then the drive resets the block to empty and marks it as available.
This improves write performance because SSDs can only write to empty pages (they cannot overwrite pages that have already been written, instead they'd have to first reset the page and then write a new page) so by proactively resetting pages, they have pages ready to be immediately written.
But this also means that the blocks containing your deleted file will be proactively reset/emptied which means it will uncharge the cells which is equivalent to all the bits being `1`, thereby destroying the file.
NSA and FBI both approached previous bitlocker devs to insert backdoors in the early days. It's no secret Microsoft cooperates with federal government branches to ensure the government keeps using their products. Further because bitlocker is closed source, there hasn't been any outside research done on the code.
full disk encryption is a thing. it's amazing how people who are otherwise technically competent leave such obvious incrementing evidence on computer