Comment by ja27

My understanding is that they know the file hashes and path they were written to from logs of the tool he used to download them.