"Show me just what Mohammed brought that was new, and there you will find things only evil and inhuman, such as his command to spread by the sword the faith he preached." - Manuel II Palelologus
You asked how you prove a negative - first part would be to avoid illegal behavior, so you don't get into this mess. He's not a law abiding citizen, he's a participant in a criminal activity. The only question here is if the money came from drug income or from real income - pull out the last twenty years of tax returns, should be very easy to prove that money is legitimately earned savings.
But you know as well as I do, when someone breaks one law, they generally break many more. Likely under the table income fueled that pile of cash, and almost any drug user is more than willing to 'get a little for their friends', or show others 'how this really manages pain.' Providing evidence of income would be a good step in the process, a decade worth of tax returns would be nice, but I think you and I both know this guy won't be able to prove the income.
My only real disagreement with the forfeiture process is the lack of appeal by jury. Someone wants to fight having their money, their home or their car taken, they should be able to go before a jury of their peers. If the guy had a couple ounces, and the government can't demonstrate a drug history, a dealing history, and he's got some explanation that 12 people can accept, he should get his money back.
The evidence can be in the money itself. If he really saved it over many years, then the bills would be dated back to when he began saving it. A comparison of the distribution of the dates in the population of his bills with that of bills now in circulation could prove that it was accumulated over the decades. I would think that the Feds already know what’s actively in circulation.