If an attacker uses proxy list from a US based company, investigators can use the logs to retrace the attacker's real IP address (even if the proxies are in China, logs should be kept).
If the company was based elsewhere, no diplomatic relations with the US/Europe, no logs.
What can an investigator do in this case (not the NSA)?
Particularly, is the proxy chain reversible in some other fashion or will the investigators be forced to follow other leads?
Alas, I couldn't find much info from the perspective of normal security investigators, but I did find:
- Does a chain of proxies make tracing the original IP harder/impossible?
- Is using VPN, Tor and ProxyChains together more secure?
However, these are not exactly my question.