I have a client that wants me to begin doing research on finding the origin of a persistent attacker to their network and employees. I haven't gotten the specifics yet, but I'm trying to think of ways and what tools I would use to find the origin of an attack. I know of data-mining tools to use but these would be useless until I can pinpoint where this attacker is located. What is the best practice (using Kali Linux's toolbox) that would help figure out the end point? 

Thanks!