Ethernet cards have a unique MAC address that is assigned during manufacture. If you capture a MAC address, and no other information, can you trace this to an individual?
Perhaps the manufacturers keep records of what MAC address goes in each batch? A retailer could connect a MAC address to a transaction, and reveal the identity of the buyer. If this is manufacturer-specific, I'd be interested in any manufacturers known to record this information. Also, any indication of how readily retailers would respond to such a request.
The context is that I'm writing fiction. The hacker is being traced, law enforcement have compromised his browser, but he's using Tails with physical separation. His one mistake is forgetting to change the MAC address on his internal firewall.