Suppose that someone hacks a website, and suppose that the police find what the hacker's IP address was at the time of hack, and they contact the Internet Service Provider to resolve the IP address to the real person behind it.
Phase 1: Now, for this, the police need to submit a subpoena to the ISP. After this, the ISP would search which one of its subscribers was using the IP address (submitted by the police) at the time mentioned by the police (the time of the hack). The ISP would find the subscriber and submit it to the police.
Phase 2: The police will have the address of the subscriber (the hacker) and arrest him/her.
I want to get a general idea as to what is the maximum possible time that Phase 1 should usually take. How long could "the search for someone by their IP address by their ISP" take, assuming that merely submitting a subpoena itself is a very very short process (1-5 days; but do correct me if I am wrong)?
Is the "searching for the person from their IP address by their ISP" a quick process like searching for a Wikipedia article about Stack Exchange? Or is it a time consuming process?