In recent years, investigators have been using customized clients to serve child porn, and track which peers receive it from them. For IPs in their jurisdiction, they get and execute search warrants.
Although there is arguably plausible deniability, most defendants lack the will and resources to fight. So they typically plea bargain.
Anyway, if you use Tor, they can't find you. But it's not as simple as that, really. Basically, you lease a VPS, working ~anonymously via Tor. You run a Freenet node on the VPS, and access the webGUI as a Tor onion service. They can take down the VPS, if they like, but won't know who was using it.