Bottom-up. The FBI sees that you're having a TLS conversation at X time with a server in Facebook's IP range, so they just go ask Facebook for what you were doing at that time.

Foreign-hosted services seem like they'd be hard to crack, but it's extremely likely their data flows though Cloudflare, Amazon, GCE, or a similar US-based company.