I see. I think this is my understanding of where the hashes come in -- law enforcement doesn't keep child porn around for comparison. That would be asking for abuse. They instead keep a list of cryptographic hashes of identified child porn files, and they want to see if this hard drive, once decrypted, has any files that match those hashes.

Seems easily defeated by a technical adversary, but probably good enough for most police work.