6. Basics: How to decide whether my action is safe?

It highly depends on what you are doing. I will give my opinions on particular situations.

1. DO NOT LEAVE YOUR DEVICE UNLOCKED if you suspect someone might take it to retrieve data. It is easy and anyone could do it because it is open at the time of theft...

2. DO NOT PART WITH YOUR DEVICE WHILE POWERED ON. Make sure it is powered off or RAM is perfectly wiped (effectively the same thing).

Password and decryption keys to things you decrypted during that session are stored in RAM. RAM can be read and extracted for passwords/keys if cops or mean people are prepared. In case cops try to take away your device while it is still on - do everything to power it off. RAM clears itself after a few minutes of lack of power and passwords/keys disappear with it. If you fail to power your device off or wipe RAM - then you are done and it only is a matter of time when they go through everything.

This is called "cold boot attack" and Interpol loves it.

They will use a freezing spray to cool your RAM sticks down as much as possible (cold RAM persists significantly longer and gives them more time).
They will rip the RAM out of your device, insert it into their machine and create a dump of your RAM onto a hard disk to later analyze (they will look for keys and passwords in particular). Once they got your RAM cloned you are done, they will find the passwords and keys.

2 minute video of how it is performed:
https://www.youtube.com/watch?v=XfUlRsE3ymQ

COUNTERING COLD BOOT: my suggestions and methods

ALL SYSTEMS

Enable RAM wiping in your motherboard's BIOS on shutdown, it is the most effective (if not the only) method but not every BIOS offers it

LINUX

Make an extremely easy mechanism resulting in your machine shutting down.
a) I have a switch to my power socket always nearby, I would dive towards at any moment to cut off power to the PC
b) My laptop has settings in such way that it cuts off power on lid getting closed

The more time you manage to waste - the greater the chance that your keys fade away in time. Immediately power off if they yell that they have a warrant and they are gonna break the door. It is also good to make RAM hard to get to physically, like screwing everything properly, or smearing all your screws with a glue so strong it would take them a bit before they get to it and they will not get to it in time because it would surprise them and catch them unprepared.

Additionally if you use SWAP memory - you can run a script to overwrite SWAP on shutdown. As far as I know you cannot overwrite RAM from kernel level and SWAP is the most you can do.


GRAPHENE OS

Graphene has a default setting where your phone gets rebooted after 18 hours of being unlocked last time, effectively wiping RAM (getting it to "before first unlock" state). You can change that timer to even lower values. What happens in reality is that your phone just restarts and that is sufficient as you need the password to decrypt your stuff unlike in many systems. Everything is automatic in this functionality.

If the police grab it from you and fail to unlock the password in 18 hours - then they cannot analyze RAM or the disk without the password. I use a Pixel phone and it seems to have a chip that will enforce that password time cooldown - if they evade that chip then the device won't boot as it is a dependency for my particular phone (I believe). I have not done sufficient research to truly be sure what it does but I feel confident enough to smirk at them seizing my electronics.

Graphene has also a function where you can use one password to unlock your phone like every phone, and another password that when used - wipes the whole device's memory and RAM. Absolutely zeroing out hard memory and then wiping RAM.

Once they get your phone they will go brute force or dictionary with it - so use a short and common password as that wipe password so that it is absolutely certain they will destroy everything for you without even knowing it before they find the real password. Once they type in your self destruct password (easy, short and common password like "1234") you can feel confident that they are not getting anything. You could sue them for destroying evidence LOL. How ironic.

I heard of SD drives having traces of memory left on nano level and I have not researched it but since they are regular transistors then I would not be surprised. I presume it to be so ineffective that I will not care if my memory is 256gbs and entirely encrypted.