I agree with everything you've said thus far, however, I'm still curious as to how the Π would go about reconstruction w/out using their already gathered knowledge to get warrants/subpoenas.

They could hope the ∆ was using BT and had their IP logged for downloading copyrighted material. Then maybe request a warrant for their computer that way but that seems like a stretch.