4:49 AM
Remember that filesystems contain timestamps, sometimes even access timestamps, so you should assume that the complete history of the filesystem in the outer volume can be recovered. If that history does not look like legit activity, it's suspicious.
For example, are there hundreds of files, but the filesystem layout and unallocated space show that no files were ever copied, moved, or renamed?
Does the timestamp data show all the files were created at once (shortly after the filesystem itself was created), not over time, indicating virtually no activity on the filesystem since creation? That would imply you only dumped a bunch of stuff to it once and never opened it again, so if your cover story is that it's your dirty porn collection, it'll be possible to prove your claims inconsistent.
From a purely technical point of view, the deniability of a VeraCrypt volume is dependent only on the security of the hidden volume passphrase and the underlying cipher, which means it's pretty damn strong.
Oh also, putting it on an SD card or any solid state device might be a bad idea due to wear leveling, which might give away the presence of the hidden volume.
2 hours later…
7:39 AM
2 hours later…
9:32 AM
> HTTP/1.1 200 OK
Date: Sat, 29 Dec 2018 09:56:24 GMT
Server: Apache/2.2.15 (RedStar4.0)
X-Powered-By: PHP/5.3.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 5623
Connection: close
Content-Type: text/html
Date: Sat, 29 Dec 2018 09:56:24 GMT
Server: Apache/2.2.15 (RedStar4.0)
X-Powered-By: PHP/5.3.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 5623
Connection: close
Content-Type: text/html
9:47 AM
« first day (2935 days earlier) ← previous day next day → last day (1950 days later) »