The kernel can use swapfiles as backing store for a
tmpfs filesystem: if the kernel decides that it needs to swap out something to free up physical RAM, the contents of the filesystem are candidates for swapping out, either in whole or in part. If you're lucky (or unlucky), coherent pieces of data will wind up in the swapfile for an investigator to see. Even if parts of the filesystem get swapped out, though, recovering data will be difficult: since the filesystem metadata may not be present and data may be in random order, it's more akin to performing forensics on a memory dump than on a filesystem.
If the computer is still running with the filesystem mounted, it may be possible to perform a DMA attack to recover the contents of RAM. In this case, forensics will be easy, particularly if the swapfile can also be dumped, because the entire structure and contents of the filesystem is accessible.
If the data does not get swapped out and a DMA attack is not possible, the only option is a cold boot attack to try to recover the contents of RAM before it decays.