Comment by dmix

Having read various police forensic reports, I'd say this is normal. They need the hash of the image to do a forensic sweep of his computer. The search for porn would be mostly automated, especially considering they are searching for one specific image which is probably what the warrant was limited to.

Then they would probably want to compare the image itself if it was detected on the harddrive, instead of relying purely on the file hash.