The FBI is constructing a detailed timeline of the still-hazy years between when Syed Rizwan Farook and Tashfeen Malik became self-radicalized on the Internet and when they launched the deadly attack in San Bernardino.
The effort could take months, according to two federal officials, as investigators in California, Pakistan and Saudi Arabia scour for leads and witnesses — and attempt to resolve several pivotal mysteries in the case.
Who knew of the married couple's growing devotion to jihad? Did anyone know of their plot to kill Farook's co-workers?
Did the couple plan other massacres that day? And where did they go between the shooting rampage before noon on Dec. 2 and the shootout with police that killed them four hours later?
"All of this is going to take a while to get all we can learn," said one of the two officials, who spoke on condition of anonymity because the investigation is ongoing and so as not to jeopardize the prosecution of Enrique Marquez Jr., who was arrested last week on multiple felony charges related to the case.
FBI agents are poring over video surveillance tapes, interviewing witnesses and reviewing forensic and digital evidence recovered from the couple's car, cellphones and other possessions. They also are creating logs of everyone who knew the killers.
"The next thing is for us to compile everyone who might have come in contact with them," one of the officials said.
In a federal court affidavit supporting the charges against Marquez, authorities sketched out some of the emerging timeline with details from the day of the tragedy.
FBI Special Agent Joel T. Anderson wrote that "an individual subsequently identified as Malik" began searching social media sites for information on Islamic State at 8:43 a.m. It's not clear if she used a smartphone or a laptop, or where she was at the time.
Five minutes later, Farook or his wife drove a rented black Ford Expedition up to the Inland Regional Center, where his co-workers from the San Bernardino County Health Department were holding a staff meeting. Farook apparently entered the building alone.
According to the affidavit, he placed a black bag containing three galvanized steel pipe bombs that were "armed and ready to detonate" on a table in a meeting room. The pipes were filled with smokeless powder and wired to a toy car's remote control that was supposed to detonate them.
He left the building at 10:37 a.m.
Just before 11 a.m., the document states, the black Ford pulled up again and "at least one individual, who was believed to be dressed in black tactical gear" got out and "shortly thereafter opened fire and shot at numerous individuals both inside and outside" the building.
Although that suggests only one person carried out the slaughter, the affidavit states elsewhere that "two individuals entered the [center] and shot and killed 14 people and injured at least 22 others," and then left.
"It didn't take long," one of the officials said of the carnage.
At 11:14 a.m., Malik was back on social media, using Facebook to pledge allegiance to Abu Bakr Baghdadi, the leader of Islamic State.
The couple then disappeared for four hours. Investigators suspect they spent at least part of the time in an unsuccessful attempt to set off the pipe bombs from their car.
Shortly after 3 p.m., police watching their home in Redlands saw the Ford Expedition drive up. After a chase, the couple were killed in a firefight not far from the San Bernardino center.
Marquez, who spoke with FBI investigators for 10 days after the shooting, was charged with conspiring to give material support to terrorists and unlawfully purchasing the two semiautomatic rifles used in the attack.
He has been denied bail and, if convicted of all charges, could spend as long as 35 years in prison. He has yet to enter a plea; his next court appearance is Jan. 4.
Federal investigators also are hunting for clues into how Farook, who was born in Chicago, and Malik, who was born in Pakistan, separately self-radicalized before they met and got engaged in October 2013 in Mecca, Saudi Arabia.
The FBI has said that Farook and Marquez began plotting possible terrorist attacks in 2011, including shooting students in the cafeteria at Riverside City College and ambushing motorists along the 91 Freeway.
The federal officials said it could take months or longer to determine whether anyone other than Marquez assisted Farook and his wife, even tangentially.
They also want to know whether Islamic State or some other foreign terror organization recruited — rather than simply inspired — the California couple to act. So far, no evidence suggests they had outside support.
"It's a process of ruling things out," one of the officials said.