In theory the accused is innocent until proven guilty, and thus should only need to suggest that the data is random, and pass the burden of proof back to the prosecution, who now have to prove the random data is encrypted.

File headers, existence of cryptography software and manuals, etc might be useful. Admission that the data is encrypted is stronger.

(http://www.computerweekly.com/blogs/the-data-trust-blog/2009...)