Just a note: it's possible to identify encrypted information by its entropy signature. Forensic tools exist that can scan a filesystem (or a raw block device) and highlight likely locations of encrypted data.