> Do they encrypt known CP files with the FileVault key and then compare?

This shouldn't work because if they had the key (which should be encrypted with the password) then they could also just decrypt the rest.

Somebody on IRC said that maybe the encrypted filesystem saves hashes of the files unencrypted, but not sure if Apple's FileVault does this.