Ah, that makes sense.

One question about the correlation attack you mentioned:

"/u/4920394 sent an image to tor at 5:34PM." But they (the VPN provider) would just know that an image was sent, and they wouldn't know what the image was or what site it was sent to, right? I see how "that very same image happened to be uploaded to XYZillegalsite.com at 5:34PM" would be traceable, but for them (the VPN provider, or a federal agency stalking the VPN provider's logs) to trace it they would have to actually be monitoring the XYZ site itself, since the TOR data going through the VPN servers would be unreadable, yes? Basically the question is, for a correlation attack to work from the fbi's perspective, they would have to look at the user's ISP to find out which VPN they're using using, make their VPN provider keep logs if logs aren't already being kept, stalk said logs, be monitoring the XYZ website by chance, and then have nothing to connect the user to an image other than the time the image was sent, because in the TOR data that was snagged from VPN logs both the website & the image would be encrypted, right? Would that even hold up in court, having nothing to connect somebody to an image but the time the image was sent, assuming the harddrive was dbanned by the time any sort of raid was conducted? And finally, wouldn't getting these logs about when an image was sent me *much easier from an ISP than a VPN provider? So isn't it better to use a VPN than your regular ISP to connect to TOR in this sense? I'm sorry if that doesn't make sense, the wording may be a little off since this is all still a little confusing and new. Thank you again!

(By the way, this is all hypothetical and im asking about anybody in general, not myself - but thanks for your answers)