[themaninthedark]

It depends on how the attack was crafted:

Step 1: Get copies of pictures of targets kid in bath from phone/SNS

Step 2: Manipulate pictures so that hash collides with CSAM

Step 3: Get pictures back on targets phone so they get scanned.

If it were me, I would try and get a series of photos from the target, and manipulate several that look most borderline. That way it looks like more than a one off.

Now if there is an Apple review, the person who views them will see some suspect pictures and would confirm.

Now the target would have to get someone to review the original pictures vs the modified pictures. Good luck with the defense.