My guess would be in data found on unencrypted drives that reference files on the encrypted drive. For example, you might have filenames that hint at child pornography in metadata (itunes, WMP, etc.) or CLI history.<p>Sure, the file might be unfortunately named, but, in this case maybe it was enough evidence to hold him?