[mrunkel]

This. It's encrypted data. You can't even see where the files are.

I can only surmise that this means that they scanned the content of the hard drives and found data sequences that matched some file hashes of known child pornography.

[cerebellum42]

If that's the case, why do they even need the drive to be decrypted? All they'd have to prove is that the drive was not owned by anyone other than the accused and could then say that there was CP saved onto this drive by the guy.

If they matched the hashes to data on the drive, the files are already on there unencrypted. Could be some space left by a now-deleted unencrypted partition, or maybe some leftover data in a temporary location where the data is saved before being encrypted.

Together with the witness testimony, that seems pretty compelling.

[pc86]

I don't even think they'd need to prove that. It's there and it's in his possession, isn't that alone a crime?