I have assisted law enforcement in a number of cases, particularly on the investigation and early forensics of a hacking attack, and have acquired some feel for the problems they are facing. I should emphasize that my experience is mostly limited to assisting law enforcement, in particular U.S. law enforcement. I have not appeared in a court of law, and am not a lawyer. When dealing with a hacking attack, the hardest problem for law enforcement is the identification of the attacker. All but the stupidest attackers launder their attacks through intermediates, usually many of them.
Accomplished hackers keep lists of hundreds of compromised hosts.
When they wish to attack a target, they launder the attack through computers in different countries, and often through different media, such as telephone or X.25 networks. Some hosts may well be chosen as legal havens, where local laws or ignorance can interfere with the trace back of an attack. Quick forensics are needed by both the police and the victim. The police need to find where the attack came from. The source and nature of the attack may be discernible from post-mortems on the attacked systems.