Unless they disassemble this drive, a forensic dump will only show the open partition.