Comment by __MatrixMan__

I worry about approaches like this because maybe the forensics tool fills all available space and then clears it, noticing that this particular phone is an anomaly re:

    manufacturer published space = allegedly available space + size of known files

If you're hiding something in "empty space" it won't behave like empty space when you try to fill it.

I think we need to be stenographically smarter. Like if there's some mechanism of deduplicating blocks across volumes, then perhaps when given the special key you could temporarily render a volume whose parts are hidden in the data already occupied by the other volume and then just run it in memory so that a reboot clears it.