I could be wrong on this, and I lost where I was looking at it, but near as I could figure out he was part of a file sharing network that was passing the CP around. And thus he got popped.
Bingo. That's how people get popped on that sort of thing (and copyright infringement too, but of course that's far less dire). Cop computers join these P2P networks and ask if anyone has file X available to share and log all IP addresses of computers that respond. They then get the ISP to tell them which of their customers was using that IP address, bust them, take all their computers and storage media, and then run automated programs on them that look for known illegal files.
Her bro is innocent until proven guilty, of course, but cops can't just go arresting you and searching your computers unless they've got probable cause. It's theoretically possible that someone else, like a neighbor stealing his wi-fi, was actually the one doing the sharing, and that the stuff on his drive was really there due to its previous owner, but if they can match the files they suspect he was sharing with what they actually found on his computer, he's in deep trouble.
But yes, of course, the relevant story here is "presumption of innocence for me but not for thee."
As Nick has said in the past. DO NOT GO TO THE POLICE WITH CP. They will charge you. Do not open the files delete them and forget that you ever found that disgusting shit. I am a law enforcement fan, but don’t try and play the hero with CP that shit will get you in trouble if you stumble across that.
This. If you ever find it on a system you have control over, delete it as thoroughly as you can - don't just use the trash can/recycle bin; use a "secure erase" program which will write over the erased data on the disk with random data. Then never mention it to anybody, including any law enforcement.