An IP address (which is matched to a specific "customer" MAC address or login name. ISPs do log this stuff.) is enough for probable cause and a search warrant. The law enforcement agency then executes a search warrant and finds evidence, and the case is further built off of this. If the case goes to trial, the IP address is a mere stepping stone in the prosecution's case, and not much more.