I think they're also looking for other files, whose hashes they don't have forensic evidence of, to secure a stronger conviction (e.g., they might suspect him of producing child pornography and not just downloading it, and so they're looking for files whose hashes they don't already know).