In addition to what @schroeder wrote, I would like to point out a few things about geolocation.

Among other things, a CDR (Call Detail Record) contains information about the cell tower used by the mobile phone at the time. Note that a cell tower can cover an area of about one square mile, or more.

In some countries, mobile operators might always be able to store (in other countries, this way only be possible with a warrant) the strength of the signal received by the closest cell towers. Under certain conditions, they can use triangulation in order to obtain a higher accuracy in the location from which the email was sent. In other countries, as I have already said, mobile operators might triangulate a user only after a warrant. In this case, the police may obtain the current position of the phone as follows:

1 - Police obtains IP address from the email servers;

2 - using the IP address, they identify the mobile phone;

3 - police obtains a warrant, sends it to the operator, and if the phone is still on, they can triangulate it to its current position.

Another thing that is theoretically possible works like this. Every device which can be connected to the Internet, including a smartphone, has a MAC address.

Now, if you connect to a public Wi-Fi network, the access point (basically, the device which connects the users to an ADSL connection or whatever used by the Wi-Fi owner) may choose to log the MAC addresses of its users and store them for some time.

If this is legal (no idea), and the log is stored for a long enough period of time, and if the mobile phone used that Wi-Fi network, the police may find the cell used by the mobile phone, ask the MAC address log to the access point owner (this may require a warrant, I really don't know) and confirm that the user actually used that Wi-Fi network. Since a typical access point has a range of 100 meters or so, this may narrow down the area. If the police are really lucky, they might even be able to identify the user (who may use a phone whose owner is another person, e.g.borrowed or stolen) by checking the footage from surrounding CCTV cameras.

Please note that, in most cases, these investigations require a significant amount of luck, time, and/or warrants. Plus, a lot of these techniques can be defeated by a skilled criminal, so if the suspect is a "hacker" he/she can further complicate the process.

In addition to what @schroeder wrote, I would like to point out a few things about geolocation.

Among other things, a CDR (Call Detail Record) contains information about the cell tower used by the mobile phone at the time. Note that a cell tower can cover an area of about one square mile, or more.

In some countries, mobile operators might always be able to store (in other countries, this may only be possible with a warrant) the strength of the signal received by the closest cell towers. Under certain conditions, they can use triangulation in order to obtain a higher accuracy in the location from which the email was sent. In other countries, as I have already said, mobile operators might triangulate a user only after a warrant. In this case, the police may obtain the current position of the phone as follows:

1 - Police obtains IP address from the email servers;

2 - using the IP address, they identify the mobile phone;

3 - police obtains a warrant, sends it to the operator, and if the phone is still on, they can triangulate it to its current position.

Another thing that is theoretically possible works like this. Every device which can be connected to the Internet, including a smartphone, has a MAC address.

Now, if you connect to a public Wi-Fi network, the access point (basically, the device which connects the users to an ADSL connection or whatever used by the Wi-Fi owner) may choose to log the MAC addresses of its users and store them for some time.

If this is legal (no idea), and the log is stored for a long enough period of time, and if the mobile phone used that Wi-Fi network, the police may find the cell used by the mobile phone, ask the MAC address log to the access point owner (this may require a warrant, I really don't know) and confirm that the user actually used that Wi-Fi network. Since a typical access point has a range of 100 meters or so, this may narrow down the area. If the police are really lucky, they might even be able to identify the user (who may use a phone whose owner is another person, e.g.borrowed or stolen) by checking the footage from surrounding CCTV cameras.

Please note that, in most cases, these investigations require a significant amount of luck, time, and/or warrants. Plus, a lot of these techniques can be defeated by a skilled criminal, so if the suspect is a "hacker" he/she can further complicate the process.

In addition to what @schroeder wrote, I would like to point out a few things about geolocation.

Among other things, a CDR (Call Detail Record) contains information about the cell tower used by the mobile phone at the time. Note that a cell tower can cover an area of about one square mile, or more.

In some countries, mobile operators might always be able to store (in other countries, this way only be possible with a warrant) the strength of the signal received by the closest cell towers. Under certain conditions, they can use triangulation in order to obtain a higher accuracy in the location from which the email was sent. In other countries, as I have already said, mobile operators might triangulate a user only after a warrant. In this case, the police may obtain the current position of the phone as follows:

1 - Police obtains IP address from the email servers;

2 - using the IP address, they identify the mobile phone;

3 - police obtains a warrant, sends it to the operator, and if the phone is still on, they can triangulate it to its current position.

Another thing that is theoretically possible works like this. Every device which can be connected to the Internet, including a smartphone, has a MAC address.

Now, if you connect to a public Wi-Fi network, the access point (basically, the device which connects the users to an ADSL connection or whatever used by the Wi-Fi owner) may choose to log l the MAC addresses of its users and store them for some time.

If this is legal (no idea), and the log is stored for a long enough period of time, and if the mobile phone used that Wi-Fi network, the police may find the cell used by the mobile phone, ask the MAC address log to the access point owner (this may require a warrant, I really don't know) and confirm that the user actually used that Wi-Fi network. Since a typical access point has a range of 100 meters or so, this may narrow down the area. If the police are really lucky, they might even be able to identify the user (who may use a phone whose owner is another person, e.g.borrowed or stolen) by checking the footage from surrounding CCTV cameras.

Please note that, in most cases, these investigations require a significant amount of luck, time, and/or warrants. Plus, a lot of these techniques can be defeated by a skilled criminal, so if the suspect is a "hacker" he/she can further complicate the process.

In addition to what @schroeder wrote, I would like to point out a few things about geolocation.

Among other things, a CDR (Call Detail Record) contains information about the cell tower used by the mobile phone at the time. Note that a cell tower can cover an area of about one square mile, or more.

In some countries, mobile operators might always be able to store (in other countries, this way only be possible with a warrant) the strength of the signal received by the closest cell towers. Under certain conditions, they can use triangulation in order to obtain a higher accuracy in the location from which the email was sent. In other countries, as I have already said, mobile operators might triangulate a user only after a warrant. In this case, the police may obtain the current position of the phone as follows:

1 - Police obtains IP address from the email servers;

2 - using the IP address, they identify the mobile phone;

3 - police obtains a warrant, sends it to the operator, and if the phone is still on, they can triangulate it to its current position.

Another thing that is theoretically possible works like this. Every device which can be connected to the Internet, including a smartphone, has a MAC address.

Now, if you connect to a public Wi-Fi network, the access point (basically, the device which connects the users to an ADSL connection or whatever used by the Wi-Fi owner) may choose to log the MAC addresses of its users and store them for some time.

If this is legal (no idea), and the log is stored for a long enough period of time, and if the mobile phone used that Wi-Fi network, the police may find the cell used by the mobile phone, ask the MAC address log to the access point owner (this may require a warrant, I really don't know) and confirm that the user actually used that Wi-Fi network. Since a typical access point has a range of 100 meters or so, this may narrow down the area. If the police are really lucky, they might even be able to identify the user (who may use a phone whose owner is another person, e.g.borrowed or stolen) by checking the footage from surrounding CCTV cameras.

Please note that, in most cases, these investigations require a significant amount of luck, time, and/or warrants. Plus, a lot of these techniques can be defeated by a skilled criminal, so if the suspect is a "hacker" he/she can further complicate the process.