Re: Absence of evidence = evidence of deletion?
The article on Wired says that the investigators put malware on the site, which was "placed" on the visitor's machines. The machine's address, MAC address, various other identifiers, and Tor browsing history were gathered.
Plus when the agents executed their search warrant, DeFoggi was in the process of downloading a porn video, and the agents had to physically wrest the notebook computer from him.
So, yeah, they caught him in the act, and they had plenty of evidence.