As far as I understand, the evidence was discovered after his devices were seized, so even if it hadn't been sent to a server, his browser history was enough to get him into trouble.