Philip Mudd, a former senior official at the FBI and the CIA, said investigators are extraordinarily skilled at plowing through huge amounts of data to shake loose one identifying piece of information. That, in turn, can unlock other avenues of inquiry, many of which are not visible to the public, Mudd and other former FBI agents said.
After the 1995 Oklahoma City bombing, for instance, the FBI found and identified within hours of the explosion the rear axle of the truck that held the bomb, according to Robert A. Ricks, a former FBI agent who had been in charge of that investigation.
Through the vehicle identification number, the bureau learned that the axle came from a Ryder truck rented in Junction City, Kan. The renter used a fake driver's license, but a survey of motels in the area turned up a visitor driving a Ryder truck. That person turned out to be Timothy McVeigh, the man who detonated the truck bomb that killed 168 people.
"One thing leads to another," said Ricks, who is now the police chief in Edmond, Okla.
A database search showed that McVeigh was stopped near Perry, Okla., just over an hour after the bombing for driving a vehicle without a license plate. He was arrested when the state trooper realized that McVeigh had a concealed weapon.
"A mistake is gold," Mudd said.
Once they have a suspect, investigators start to build a timeline of the person's actions leading up to the event, including the use of cellphones to identify potential accomplices. Search warrants are then issued to obtain call, e-mail and text-message records, which help fill out the picture.
"All of these investigations involve plumbing every potential source of information and combining them to get a full picture," said a former federal prosecutor, speaking on the condition of anonymity because the investigation is ongoing.