Washington — Investigators are convinced that the explosive devices that killed three people at the Boston Marathon were not in place before the race began because of sweeps by security teams. And since Monday they have focused on increasingly narrow slices of the five-hour window between when the marathon started and the blasts occurred, according to U.S. officials.
This methodical dissection of terabytes of video, still images and other evidence led the FBI to images of a potential suspect Wednesday. The apparent breakthrough illustrates how private surveillance equipment, in combination with the cellphone cameras used by ordinary citizens, has become an extraordinary resource that allows investigators to re-create the visual narrative of the streetscape surrounding a location in order to scrutinize the hours, minutes and seconds ticking down to a crime.
"There is absolutely going to be video of almost every single inch, for every single second of that day; it's just a matter of finding it," said Andrew Obuchowski, a former Massachusetts police officer who analyzes video evidence for Navigant Consulting, a private firm.
Video has proven crucial to a number of high-profile international investigations in recent years. In Dubai in 2010, the suspected assassins of a senior figure in the Palestinian group Hamas were captured on hallway video cameras in the hotel where the target, Mahmoud al-Mabhouh, was staying. In London in 2006, the city's ubiquitous closed-circuit video cameras were used to trace the movements of Alexander Litvinenko, a former Russian security agent, on the day he was poisoned with a radioactive isotope.
Along with the forensic examination of residue from the bombs, U.S. officials said, investigators are focusing heavily on the enormous volume of video footage and images taken by security cameras and spectators and turned over to the FBI.
The bureau's website offers instructions on how to submit footage of interest in the investigation, and the effort to gather it is so extensive that security officials at Logan Airport have been asking travelers leaving Boston whether they have data that could be useful.
Officials said they are organizing the video footage and digital images according to precisely where and when they were taken, relying on an array of clues to determine locations along the race route and the time that specific pictures were snapped. The fact that the bombing occurred at a marathon — an event that records runners' finish times in fractions of a second — has aided the effort. Investigators have used the numbers worn by runners to determine their finish times and then extrapolated backward to determine when they crossed key landmarks on Boylston Street, where the blasts occurred.
Pictures taken by cellphones also typically have time stamps and, in some cases, GPS location data.
"It's like a puzzle, but it's in color and it's four-dimensional because of the time element," said a U.S. intelligence official monitoring the investigation.
Investigators are reconstructing scenes of the explosions from as many angles as possible, seeking to narrow their search to the window during which the devices were placed.
One U.S. official compared the effort to the massive endeavor after Osama bin Laden's 2011 killing in Pakistan to sift quickly through the files and computer records recovered from his compound — except that in this case, the FBI, not the CIA, is in the lead role.
Often, investigators scrutinizing this kind of video evidence will use software that lets them add specific descriptions of a person they have observed in some of the footage and other data to attempt to find the individual in other videos from the scene, according to Grant Fredericks, a forensic video analyst who has taught classes for the FBI.
Philip Mudd, a former senior official at the FBI and the CIA, said investigators are extraordinarily skilled at plowing through huge amounts of data to shake loose one identifying piece of information. That, in turn, can unlock other avenues of inquiry, many of which are not visible to the public, Mudd and other former FBI agents said.
After the 1995 Oklahoma City bombing, for instance, the FBI found and identified within hours of the explosion the rear axle of the truck that held the bomb, according to Robert A. Ricks, a former FBI agent who had been in charge of that investigation.
Through the vehicle identification number, the bureau learned that the axle came from a Ryder truck rented in Junction City, Kan. The renter used a fake driver's license, but a survey of motels in the area turned up a visitor driving a Ryder truck. That person turned out to be Timothy McVeigh, the man who detonated the truck bomb that killed 168 people.
"One thing leads to another," said Ricks, who is now the police chief in Edmond, Okla.
A database search showed that McVeigh was stopped near Perry, Okla., just over an hour after the bombing for driving a vehicle without a license plate. He was arrested when the state trooper realized that McVeigh had a concealed weapon.
"A mistake is gold," Mudd said.
Once they have a suspect, investigators start to build a timeline of the person's actions leading up to the event, including the use of cellphones to identify potential accomplices. Search warrants are then issued to obtain call, e-mail and text-message records, which help fill out the picture.
"All of these investigations involve plumbing every potential source of information and combining them to get a full picture," said a former federal prosecutor, speaking on the condition of anonymity because the investigation is ongoing.