Ding ding ding. This is the answer. I know OS X also stores hashes of at least some downloads for the purpose of checking certificates on downloaded apps and disk images.
This is clearly enough evidence to convict the guy, so I imagine they're holding him for some political reason (like generating jurisprudence for violating the 5th amendment in the future).
I vaguely suspect they're holding him because they expect to get either a stronger conviction or more evidence for other cases from the contents of the external drive (e.g., maybe he's producing child porn or knows people who do).
This is clearly enough evidence to convict the guy, so I imagine they're holding him for some political reason (like generating jurisprudence for violating the 5th amendment in the future).