So your argument is that the entire thing is faked? Faked so incredibly well that it will withstand expert analysis at trial? That they faked years of activity

So your argument is that the entire thing is faked? Faked so incredibly well that it will withstand expert analysis at trial? That they faked years of activity (down to the inode level of the filesystem) by this guy and didn't make a single mistake? Because his defense team will tear that evidence apart and will find that mistake if it's there (e.g. any inode activity during a time he has an alibi... very easy to find). And that you find that more believable than that someone could just happen to be both a security expert and a pedophile? Do you realize he wasn't caught because of his security lapses? The found the VM because they raided his house for a separate matter. Every indication is that, with the exception of using a password he stored on his phone (which, read the indictment, he clearly realized during the interrogation that he had made a mistake), the government would have never found this VM of his. He did take the steps you suggest, and it didn't matter, because they raided his house, and he made a single, and easily understandable mistake: he stored the password he used for the VM somewhere where someone could access it digitally. If he had just memorized the password, they would have very likely never broken that encryption.