Look at the Silk Road investigation. They collected circumstantial evidence by linking the originating IP address, where the suspect lived and when DPR was logged in.
I really don't think so. There was an externally verifiable chain of evidence created by Ulbricht through random tidbits of sloppy opsec on a few occasions, enough of them for him to eventually be identified and caught. So if these existed (and they did, because they could be clearly pointed to), there was no need for parallel construction, and if there was no need for it, it presumably wouldn't have been used just because. Furthermore, if they were going to use it anyhow, why wait so long to do so when they had the needed formal evidence anyhow?
