>>2335056The web server has a log with every ip address with a timestamp and what they did, the form might be like "ip-address 2016-09-07 13:21:32.1234 get URL errcode filesize" and in some countries the host might be required by law to keep the logs.
Then you have the internet provider for the host that in most countries are required to keep the logs (which do not contain the data but just the header and size (think of the postal service that would take a picture of the labels and physical size). There is some intermediate provider that is most likely also required to keep the same logs, and finally the user's provider that also keep those logs.
The police can ask for a warrant to get the information from the forum owner, if he does not have the logs then they will ask the web hosting company. Then they find the ip address of the client, and ask for a warrant for the client's isp, which give them the account owner and address.
For those that hide behind a VPN, it get more complicated mainly due to the fact that it requires international cooperation and much more effort.
