Would it be possible to construct a file/system encryption scheme where you have a read-write passcode and a read-only passcode? Such that when given the read-only passcode it would allow (legal/valid) searches by law enforcement, but not (easily) allow fabrication of evidence by planting incriminating files?
I suppose you could make it part of a signature scheme for files (file written by passcode X) so that your defense could point to the discrepancy in your favour.
I suppose you could make it part of a signature scheme for files (file written by passcode X) so that your defense could point to the discrepancy in your favour.