1) Use Linux, preferably a distro with few services running by default and a strong reputation for security/privacy. Don't use windows or OSX.
2) Full disk encryption. Encrypted containers on the filesystem are NOT enough to thwart a serious LE investigation.
3) Whonix in KVM, preferably confined by MAC like SELinux. Properly configured, Whonix makes clearnet leaks and deanonymization leaks impossible.
4) Don't login to personal accounts or send personal info over Tor. Nearly every Tor user who has been busted by LE has made this mistake, leading to their undoing.