I have some question about the very basics of tor, as this keeps bugging me now for some time:
As far as I know every tor node is only aware of the ip address of the following node. For example the guard node knows where the next relay is, but does not know the exit node (as this information is hidden from it by encryption). The same holds true in the other direction, i.e. from exit node to guard node. This ensures that if let's say somebody gets access to the exit node the actual origin still remains hidden.
Now imagine the following scenario: All three nodes lie within countries where let's say law enforcement or agencies are known to cooperate (maybe the EU). Let's also assume that there is very little traffic over these nodes. Isn't it then possible for an attacker like law enforcement to first acquire logs from an Internet Service Provider for the exit node, figure out to which ip the exit node sent data in a specific time frame, then check the logs for the second node and so on? Does anonymity in this scenario depend on the amount of traffic making correlations in ISP logs difficult or impossible?
