From WaPo, they were investigating by browsing through pornography. They went beyond just running hash checks.
"Meade also testified that when a technician found possible pornography, it was reported to him and he “would go beyond that and look and see are there things here worth reporting to the FBI…either find what’s on that page or scroll down and find more problematic images and make that available to the FBI.”