Never say the pics are from a friend! The next question asked is the name of your friend. Just say you collect pics of appealing plants found on the internet(Google images).
I'd be careful with that argument. Tags in the image may prove it was taken with your phone, not random phones across the planet (found via Google search). I would rather be in a position of saying they are photos I took, but I refuse to identify whose plants.
What's the worst case scenario? They might offer to drop the hash charge if he turns in the names of those people cultivating. But, since he knows they're his plants, he would just reject the offer and take the hash penalty.
If the pictures contained information proving they were taken at his residence (a couch in the background, GPS coordinates, etc), that might be enough evidence to charge him with cultivation. In that case he could say someone brought the plant to his house for him to take pictures of. Continue to refuse to name that person because he's under no obligation to do so.
At this point, he would have a story sufficient for "reasonable doubt." ("They found no plants, no growing equipment, nothing. Just these photos which I've consistently said someone brought plants to my house to take photos. I had no involvement in growing them. I just took photos for my friend.").
As contrived as that story may sound, it wouldn't be nearly as bad as saying "I collected those photos off the internet" and the prosecutor demonstrating the astronomical odds of randomly downloading photos taken by the same model of phone.
I'd rather be in a position where my story may sound implausible -- but they can't prove me wrong. Once you're proven to lie, it makes it that much harder to create a "reasonable doubt."
I think we both agree that a lawyer would be the best advice to follow. And, if the OP ever accessed this forum from his phone, he probably shouldn't post here about what happened. They could identify his username from his phone (browsing history, stored usernames for auto-fill logins).