It's possible that the suspect wasn't thinking things through when he was hit with the search warrant. It says that he gave them his iPhone 5S password but not his Mac password, or the passwords for the hard drives. They apparently were able to get into the Mac (maybe the password was the same as his iPhone?) but not his hard drives. He is said to have "refused" to give those passwords. I suppose he gave up the ability to maintain a consistent defense when he said "No, I don't have/want to" instead of "I forgot".

https://arstechnica.com/wp-content/uploads/2017/03/rawlsopin...

I'm confused by this statement in the above ruling:

    The Forensic examination also
    disclosed that Doe had downloaded thousands of files known
    by their “hash” values to be child pornography.


    The files, however, were not on the Mac Pro, but instead had been
    stored on the encrypted external hard drives. Accordingly,
    the files themselves could not be accessed.

So forensic analysis of the Mac revealed that he downloaded known porn files (identifiable by the database of hashes that law enforcement uses)...but don't you need access to the actual file to be able to calculate its hash? If the files were moved to, or downloaded right to the encrypted drives, how could forensic analysis reveal the files' hash values?