Due to stories like the following: https://hackerone.com/news/pink-panther (forced at airport customs to decrypt laptop) being more and more frequent, I thought of the following. What if you simply travel with a laptop where you encrypted the unencrypted parts in a LUKS FDE setup via a script and a live cd. Your entire hard drive should look like random data and you'd have plausible deniability that you wiped your hard drive prior to travelling. Upon arriving at your destination, you simply boot your live cd, download your script from a server and decrypt /boot and your boot loader to have a working laptop again. Now I was wondering, how much would my script need to encrypt, i.e what parts in a standard FDE setup with LUKS are not encrypted.

So I use standard LUKS with a 512 MB ext2 /boot partition:

$ sudo fdisk -l /dev/sdd

Disk /dev/sdd: 238.5 GiB, 256060514304 bytes, 500118192 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: dos
Disk identifier: 0x0de4d334

Device Boot Start End Sectors Size Id Type
/dev/sdd1 * 2048 1050623 1048576 512M 83 Linux
/dev/sdd2 1050624 500118191 499067568 238G bf Solaris

The /dev/sdd2 partition is completely encrypted with AES/LUKS and should therefore be indistinguishable from random data. Would it suffice to have a script encrypt sector 0 up to 1050624 in this case? Or is my setup leaking data in other places about it being more than just random data? End of a partition at the end of the disk maybe? Should I encrypt the first 50 MB of /dev/sdd2 too?