From reading the affidavit, it appears it took a significant amount of time to break into his devices so then it became obvious what was contained within.
What was he arrested for in 2017? That was the same year the search warrant was executed and his numerous devices were collected however we don’t know what prompted that, other than obviously there was some early connection that LE were aware of.
ETA - from the affidavit, its appears a company named “Cellebrite” collected the evidence from the locked devices, some of which had been deleted.
On February 27, 2017 Kegan contacted ISP Cyber Crimes Unit and told them he located his Apple iPhone 5c that wasn’t taken during the warrant. On March 2, 201 7 the unit obtained the iPhone Sc from the ISP Peru Post.
On April 24, 2020, Iwas assigned lead investigator for this case.
On Friday, June 12, 2020 I received the digital forensic examination from ISP Sergeant Chris Cecil. I reviewed the information and below is a summary of the forensic examination.
On Thursday, June 18, 2020 multiple law enforcement officials met With the Miami County Prosecutor to discuss this investigation.
https://www.wishtv.com/wp-content/uploads/2021/12/Kegan-Anthony-Kline-PC.pdf