> Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content

How on earth is this supposed to work? Unless they can decrypt the hard drives I am pretty sure that this is impossible to deduce.

Maybe he used freenet or something in his unencrypted hard drive?