And you don't know, can't know which it is since they can remove the device from your presence. So you have to assume the latter.

Yeah, I would make that assumption if they confiscated the device and said "we'll send it back to you whenever."

But why do I feel that "derpy DHS agent browses computer for a few minutes" is far, far more likely in a scenario where the device is taken to a back room?

Is it really impossible to know anything about what is done with devices in the back room?

Let's say they had your device for 15 minutes. Thats enough to disassemble and copy a bunch of data and reassemble. Unless you have whole drive encryption they only need to copy the user folders (typically).

Or your machine might have been in a queue and only looked at for 2 minutes.

Or they might have not looked at it at all.

Now pick a few different timeframes and you tell me how hard it is to know?

15m seems like too little unless the traveler is a high-priority target. CBP is often crushed.