The feds would probably be able to use metadata and facial recognition comparison against existing CSAM databases to verify many such cases. And investigators would likely use hints such as the image resolution or comparison to other images on the drive to verify if a collection is a photoshoot or a crafted prompt for example.