There would be copies made and the drive that has the encrypted volume would likely be accessed with a "Write Blocker" forensic device, or in a virtual environment, etc.
This technique would only tip your hand that the volume contents changed after entering the password.
