Cases are handled differently when law enforcement is not involved and you are suing your cyberbully in civil court. Private legal counsel is usually retained to bring a lawsuit and moves for expedited discovery. That means the lawyer asks the judge to permit her to subpoena the IP records from the ISP before the complaint is even served in many cases. They often do not know the identity of the cyberbully when the action is brought and won’t until discovery is complete. The lawsuit typically alleges defamation or harassment and is brought against John or Jane Does. Once the defendant is identified in the discovery process, the complaint is amended to include the real defendant.
A majority of the bigger ISPs may or may not notify the subscriber of the receipt of a civil subpoena. (Recently, in response to lawsuits, some courts have demanded that the subscriber be notified and have an opportunity to contest the disclosure of their identity before the ISP is permitted to turn over that information. Some ISPs even promise their subscribers that, in the case of a civil case, they will receive notice before their information is turned over.)
Once the information including the IP address and the subscriber information is received by either the police or private counsel, it may be enough. If the cyberbully is using only one computer, or the IP address traces back to one particular computer in a network, especially if the user needs to sign in and sign off, you may not have to prove much else. But in some cases, tracing the message to a computer isn’t enough. Sometimes you need to trace it to a person and a file.