1. Dictionary attack.

If they succeeded with a dictionary attack on a password that isn't super short, I'd definitely like to know about it. And I'd like to know if it took them 5 years to do it.

2. Side channel attack... But, if anything was unencrypted there will be leaks.

This is not a side channel attack on the encrypted data. This is just retrieving data from unencrypted blocks, so it isn't an attack on the encrypted data at all. If this is what the police did, then the news article would be lying about the fact that they "uncovered enough evidence from Schurgard's encrypted files to charge him with 616 counts of possessing child pornography". Such evidence comes from unencrypted blocks of data on his hard drive, not from the encrypted files.

As far as I can tell, they just came knocking on his door one day without a warrant. And then just came back with a warrant and took his computer. So they didn't do any kind of side channel attacks, like tempest or anything.

- Heartfallen