I would assume they have evidence, maybe via a warrant to his ISP, that showed the transfer of files with hashes of known illegal content. They might have evidence content was transferred to a computer on an account in his name, but they most likely do not have evidence of his actual possession of illegal content.
How would the ISP have such hashes? Are they hashing and recording every file one downloads? And the sources of this illegal content weren't even using HTTPS, let alone Tor?
