Boston Bombing Day 2: The Improbable Story of How Authorities Found the Bombers in the Crowd

— -- [This is the second of five installments of an ABC News digital special report '5 Days', which tells the hour-by-hour, day-by-day story of the investigation into the 2013 Boston Marathon bombing, with behind-the-scenes details based on interviews and evidence gathered by the FBI and Boston law enforcement agents who worked the investigation. Click to see Day 1, Day 3, Day 4 and Day 5. '5 Days' is written by Brian Ross and reported by Brian Ross, Rhonda Schwartz, Michele McPhee, Megan Christie, Randy Kreider and Lee Ferran.]

Twenty-four hours after the deadly Boston Marathon bombings, the FBI was chasing down every lead, investigating and dismissing a growing number of potential suspects.

Some were put on round-the-clock surveillance, and the FBI launched its largest-ever aerial fleet to circle over Boston in the hunt for the bombers.

Meanwhile, one of the bombers, Dzhokhar Tsarnaev, returned to his dorm room at the University of Massachusetts at Dartmouth, where over the next two days he busied himself working out at the school gym and spending the night smoking pot and watching movies with his friends.

His older brother and accomplice, Tamerlan, remained at his home with his wife and infant daughter, just a few miles from Boston FBI headquarters.

Even though Tamerlan had been the subject of an FBI investigation as a possible terrorist just two years earlier, no one pulled his file from the bureau’s system for counter-terrorism assessments or suggested he be questioned in connection with the bombing. Russian intelligence had told the FBI in 2011 that Tamerlan was an "adherent[] of radical Islam," but the FBI in Boston at the time had found "no link or 'nexus' to terrorism,'" according to a post-attack report by the Intelligence Community's Inspector General.

The First Big Break

Soon after the bombing, FBI agents had recovered some surveillance footage from the site of one of the blasts. Shot by a surveillance camera at the Forum restaurant, the video showed the crowd at the outdoor section of the bar as well as people walking along and lining up at the street to watch the marathon runners go by.

The video seemed to be pointed just to the side of the site of the second explosion, showing a huge fireball and then the graphic aftermath. It also showed, investigators hoped, whoever placed the bomb there.

Analysts watched it and re-watched it dozens of times, but none could spot anyone that looked suspicious, much less like a mass murderer dropping off a bomb. They were stuck.

A spectator’s still photo would prove to be the turning point in the FBI’s urgent investigation. The still showed the finish line and the Forum crowd from across the street, giving the agents another, key perspective. The photo came from a man who said he couldn't get through to authorities for hours amid all the confusion, and he nearly gave up.

Finally, someone answered his call, and once the agents in the FBI’s Computer Analysis Response Team (CART) lab saw the photo, they realized they had the key to cracking the case.

“He was hidden in plain sight,” said FBI agent Kevin Swindon, who ran the CART lab in Boston. “[Before that,] we couldn’t see anything that stuck out.”

The photo, closely examined, showed a black backpack on the ground in the precise place that was what analysts said was the “seat” of the bomb -- the exact spot where it exploded, next to a tree just behind eight-year-old Martin Richard, who was killed in the blast. Standing over the backpack was a young man with a white baseball cap worn backward.

“That was the 'Ah-ha!'” said Swindon. "We said, 'That's gotta be the bomb.'"

Armed with the still photo, the agents then turned back to the surveillance video. Now the agents were able to cross-reference the images they saw in the still to what they saw on the tape. And from the 174 people seen walking in and out of the the frame, they were able to zero in on the man who they believed to be a suspect: a man in a backwards cap they would call “White Hat.”

It was a huge development. Now the agents in the CART lab played the tape backward as they tried to determine where White Hat had come from.

There was video footage that could answer that question and lead to a second suspect, but at the time, the FBI didn't know it.

'Now We're Looking for Two Bombers'

Whiskey’s Smokehouse on Boylston Street had all 36 of its surveillance cameras rolling that afternoon. A frequent target of lawsuits, the owners said they had made sure there was a video record of everything that happened inside and outside of the popular bar.

“Oh, my God, we have cameras,” recalled the manager, Becky Caloggero, after the bombs went off down the block.

But the system recorded over the previous day’s taping every 24 hours -- and time was running out. But because the area was closed off to everyone, she could not get to the bar to turn off the machine.

Finally, she got through to Boston police headquarters where Lt. Detective Mike McCarthy, an aide to Superintendent William Evans, picked up the phone.

“You need to get here right away,” she told McCarthy.

It was a race against time as the two officers scrambled to get to Whiskey’s and disable the surveillance system in time to preserve the previous day’s recording, which would turn out to be crucial.

Late that night, the Whiskey’s video was at the FBI CART lab being prepared for viewing by agent Kevin Swindon and his team.

“That was essentially our second ‘Ah-ha!’ moment,” Swindon told ABC News. “That was the ‘Wow.’”

“When we see them together, now we have White Hat and we have Black Hat, where now we’re looking for two bombers,” said FBI agent Kieran Ramsey.

Victim Describes Bomber From Eerie Encounter

Late that day at Massachusetts General Hospital, marathon spectator Jeff Bauman regained consciousness and realized one of his legs had been amputated.

He said he clearly remembered an encounter with a man in a black hat who bumped into him seconds before the bomb blast. At the time, he thought something about the young man felt off, but he had turned his attention back to the race, in which his fiancée was running.

In the hospital and unable to speak, he wrote a note to his brother, “I want to talk to the FBI.”

Agents brought a sketch artist and Bauman’s description led to a drawing of a possible suspect, that would later be acknowledged as a remarkable likeness to Tamerlan Tsarnaev.

At the time, however, agents gave it little credence.

As night fell Tuesday, the FBI believed they had grainy footage potentially showing two suspects, but they didn't know much more than that and they knew they were running out of time to track the attackers down.

"We have them visually identified,” said FBI agent Ramsey. “We still don’t know who they are. And at that time, we didn’t know where they were and what they were going to do next."

'Five Days': Research by Alex Hosenball, Cho Park, Zoe Lake and Michael Birnkrant. Video editing by Shilpi Gupta, Abhinav Bhat, and Karl Dawson.