In countries where the law does not dictate that all carriers maintain extensive logs, this is fairly simple. Whether you are a Tor node or a normal ISP, you do nothig until you get a court ordered warrant, at which point you collect information passing through your network and hand it over to authorities. So the "Tor" service remain anonymous until the police suspect illegal data passing through it, at which point they snoop what passes through and work they way up to find the true origin of the data. In countries where log files must be created and retained by law, this is less simple. Is a Tor node covered by the law ? If so, then it is non compliant of it fails to colect the law mandated logs. If the Tor node is not covered by the law, then law enforcment cannot complain if there are no logs to analyse.