@kaia that's a tough one. iirc veracrypt treats the container like it's own filesystem and doesn't really care about what's underneath (operating system/etc). if you haven't had a lot of write cycles to your machine you might be able to do some forensics on the filesystem inside the container, but it may not be worth the effort.