I presume the legal process would be something along the lines of
So I expect that this would normally require some legal warrant in most countries for ip address to user mapping, which of course can be made difficult.
Are mobiles client easier to trace?
What about an illegal but still pragmatic process?
The block chain doesn't report the IP address and the IP address isn't passes by nodes. Any entities knowledge of Bitcoin network is limited to the connections it has. If you get a transaction from a specific IP address you can't know that IP address originated the transaction you simply know it came from that IP address. It was either originated or relayed by that node.
The more connections you have to the network the more information you would have about where an transaction originated. However no matter how many connections you have you can never know you have a connection to every single node, thus all you can know when you see a specific transaction is that node at IP address X is where the transaction was first seen.
You can never be 100% sure of the originating node as you can never be 100% sure you have connections to ever node in the network.
Someone concerned about privacy could restrict the nodes they send transactions to only nodes they trust. This would ensure that at most (unless they trusted you) you could only find the node that relayed the transaction not the originator.
Someone concerned about privacy could also route their transactions via VPN which would add another layer. The connection couldn't be traced further back than the VPN gateway without the assistance of the VPN providers which likely would require a court order. If the VPN provider was located in another country that would make enforcement even more difficult.
Using both trusted nodes (using web of trust like fature), and VPN which doesn't keep logs in a foreign country would make tracing the source of the transaction very difficult.
I find it unlikely that many courts would issue a warrant based on only the IP address of the "node transaction was first seen" as it really is proof of nothing. The actually originator could be that node, a node which relayed it to that node, or a node which is x hops further down the chain.
Lastly a transaction is simply a sequence of bits. There are websites which act as dropboxes where a user can post a transaction in text form and the website will relay it to the rest of the network. While this isn't particularly secure one could create a similar service on Tor and possibly require transactions to be encrypted with a public key of trusted operator reducing the likelihood of tracing the transaction back.
Of course the drop box method could be combined with trusted nodes, VPN access, and using a public internet wifi location to further obfuscate the source. It really depends on how paranoid the sender is.
Tracking on the network layer is not how this would be done (because of the reasons outlined by DeathAndTaxes).
If an investigator wanted to track down who is behind a certain Bitcoin address (NOT IP address, more like a Bitcoin bank account number), they'd need to find out companies or individuals that have done business with that address (i.e. exchanged coins with it).
Usually, these companies would know something about the person they were transacting with. For example, a wallet site will have some user account information. An investigator could have leverage to force these companies to disclose their records.
So this is where you lose anonymity in Bitcoin: Because it is not really anonymous, but rather pseudonymous, if you let anyone find out who is behind your Bitcoin address, they will be able to associate the coins going through that address with you. And if someone can gather a lot of these associations, they can draw a great many conclusions.
Because of that, you are advised to create new addresses for every trading partner.
(This is maybe an area where using Green Addresses has a real disadvantage, because now you can easily determine that a certain wallet service has been involved in a transaction, giving investigators a place to start digging).
