I understand that copyright holders can identify illegal filesharing over BitTorrent by simply taking part in the sharing process and noting IPs of peers.
But how do they detect illegal downloads from file hosters?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
If you use a public hosting service, that service could of course also keep track of what it's hosting and who uploaded and downloaded it.
If the filehost is not a honeypot, if you use an unsecured or semisecured connection with a known protocol to transfer your files, the ISP could track whenever you initiate a file transfer. If the protocol works with an open checksum, the ISP could take that checksum and compare it to one of its databases. If they find a match, they have strong evidence that something that wasn't supposed to be shared was shared.
Now this could also work for encrypted file sharing systems such as the one hosted by MEGA, if the ISP got a hold of the keys and inspected the file, deemed it illegal, and then started tracking whoever is downloading it. (this is not hard considering most people leave the keys in the link - the ISP could backtrace your steps and inspect the pages for the hashtag keys, or defer that task to a crawling service (would probably be faster))
Alternatively, a shill (cop, digital rights holder, etc) could transfer you the files or request that you transfer the files and then rat you out.
Beyond that, a spying agency, a bored hacker or anyone being able to install software on your device (e.g. the company you have your operating system from) could have installed spyware on your computer to track what you are doing.
Finally, somebody could be looking over your shoulder.