Mehdi Masroor Biswas' twitter handle, @shamiwitness, had over 17,000 followers.
As the UK-based Channel 4 report on how an Indian was acting as the key recruiter of IS through Twitter headlined on television channels across India, a group of greying men were huddled at their base in Lutyens' Delhi.
The building - erected during the British Raj, which served as a residence of a Maharaja from Bihar - had witnessed many such huddles over the years. Veterans joke that had walls been any less thick, the building would have collapsed under the weight of secrets and conspiracies brick-walled here.
Who was Mehdi and how could an IS recruiter escape detection was the question haunting the men.
While the government kept its calm despite the vociferous Opposition attack over the conversion issue, the sudden surfacing of Indian link to IS had unnerved all. Those who act as the eyes and ears of the Prime Minister were bearing down heavily on the men: "How long will you take to get to him and how far have you progressed?"
An urgent message had already been flashed to the US for the internet logs of the Twitter handle '@SamiWitness' - the purported handle of the IS man. But as with all such requests, there was no hope of getting details on time.
Without server logs, it was impossible to know the Internet Protocol (IP) address, that gives a fair indication of the location. What other technique could they use? The group decided to fall back on tried and tested "old style policing".
Instead of tracking the IP address, they got down to tracking a t-shirt. The Channel-4 report had images of the suspect, but the face was blurred. What was clearly visible was the t-shirt he wore. What also helped was his voice. A voice analysis pointed to a man in early or mid-20s with a "Bengali" accent.
By midday, as the pressure on the investigators increased, a section got busy trawling through Facebook pages using special software, checking for pictures of people sporting similar tee-shirts. The search yielded a few hundred profiles.
"It was expected that 'Medhi' would be part of the name or assumed name and so it was easy to shorten the list of people wearing similar T-shirts," a senior official said. But the list was very long.
The search then moved on to another parallel - phone numbers of people called Mehdi. It threw up people working in very senior positions.
A dilemma gripped the group. Could they randomly question all of them? "In past, several people have lost their jobs and were ostracised because they were examined and we weren't in favour of a fishing expedition," the official added.
"We needed a lot of luck," said another official.
The voice analysis that pointed to a young man with a "Bengali" helped narrow the list.
Phone records of those on the final list of suspects showed normal activity except for the one who went by the name Mehdi Masroor Biswas. And it seemed to match all criteria - a Bengali boy in mid-20s, an engineer who was located in Bangalore.
The next step was Guru Nanak Institute of Technology - listed by Biswas in one of his public profiles - in West Bengal's Sodepur. The college had details of his employment and photo. "The rest was easy," the officer said.
A little after 11 pm , when a section of the team walked into Mahdi Masroor's one-room apartment, he was seated at his computer. The search was over.