> They no doubt had a suspect[1], got something incriminating, took it to a judge and that was enough to get Meta or whoever to cough up the logs. So literally

> They no doubt had a suspect[1], got something incriminating, took it to a judge and that was enough to get Meta or whoever to cough up the logs. So literally what I said in my original comment: >> Or, less conspiratorial, the investigators had some leads on x group of accounts -> got warrants for account IP addresses -> confirmed hypothesis.