The traffic is encrypted from relay to relay and end to end. You can theoretically prove that someone used Tor and perhaps prove that they connected to a certa

The traffic is encrypted from relay to relay and end to end. You can theoretically prove that someone used Tor and perhaps prove that they connected to a certain Hidden Service, but proving that they actually did something illegal (rather than just curiously browsing) is not easy to prove. Also, I think that each relay is unaware of their order in the flow, so the other connected nodes could be a Hidden Service, a Tor client, or just another relay.