Welcome to the forum!

As for tracing IP's back to specific machine, it's never 100%.  I think ISP's can determine which location a specific IP address was leased to, but that's where it ends.  There's no telling which computer was using that connection.  A great example of this is the modem being connected to a wireless access point.  IP's can be followed back to a router, but not to a MAC address.  Once packets are routed through a router, MAC addresses (aka hardware addresses) are dropped from packet headers and are no longer used.  But also keep in mind that connections can be anonymized (ie Tor, as you mentioned below), so the router IP being shown may be something on the other side of the world in reference to the actual user.

Emails don't contain MAC addresses (as they're routed through routers).  When using a web-based email program, all you'll see is the IP of the company who owns the web-based email program (ie Google for Gmail, etc), and the IP's of the devices the email passed through to get to it's location.  When using a desktop application for email, you may see the router's IP in the email headers that the user sits behind, but that's all.

Thanks for expanding on that, good to hear it first hand.


I've heard of this guy, but have never heard/seen him speak before.  Again, good info.  Wasn't expecting 3hrs lol...but I was interested the entire time.