Useually they get some of the hackers tools / code and analyse that to discover the origin. They look for strings in a foreign language but mostly the grammer of the language is used as hackers will often write comments in a foreign language to try and make it difficult to originate.