Trump rally shooter's duffel bag and range finder first sparked suspicions, sources say

New details have emerged about the suspected shooter at former President Donald Trump's rally over the weekend, including what first brought Thomas Matthew Crooks under suspicion.

Multiple law enforcement sources confirmed to ABC News that suspicions about the suspect were first aroused at the site by other attendees when they spotted him with a range finder and duffel bag.

Attendees then notified law enforcement, according to sources.

The suspect, who was 20, had two cell phones -- one on him and a second one found at his home, sources said.

Sources also told ABC News that Crooks came to the rally site in Butler, Pennsylvania, on the morning of the shooting, stayed there for an hour, left and then came back sometime in the early 5 p.m. ET hour.

Additionally, a source told ABC News that an individual using the name of the suspect signed up online to attend the Butler, Pennsylvania, Trump rally on July 6, a week before the shooting.

Meanwhile, the FBI told lawmakers they've conducted 200 interviews as part of the investigation, a source said.

On Thursday, the Department of Homeland Security Office of Inspector General opened its third probe into the security that led to the assassination attempt.

The agency said the third probe will investigate the U.S. Secret Service's planning and implementation activities for protective operations.

"Our objective is to determine the extent to which the Secret Service plans and implements protective activities to ensure the safety and security of designated protectees," the Department of Homeland Security Office of Inspector General said.

The announcement follows two prior probes, opened on Tuesday and Wednesday, respectively that examined the U.S. Secret Service's process to secure the campaign event and a review of the Secret Service Counter Sniper Team's preparedness and operations.

Investigators working to determine a motive behind the assassination attempt are also examining a message left on a gaming platform site purported to have been authored by the suspect, according to multiple law enforcement sources briefed on the probe.

Investigators, according to multiple law enforcement sources, found a post on the gaming platform Steam that is credited to the suspected gunman, 20-year-old Thomas Matthew Crooks. The post reads "July 13 will be my premiere, watch as it unfolds." Investigators are working to determine whether the post is legitimate.

Investigators also found internet searches for both Trump and President Joe Biden on the phone belonging to Crooks, sources familiar with the investigation told ABC News. Crooks had searched for the dates of Trump's rally in Butler, Pennsylvania, and for those of the Democratic National Convention in Chicago, the sources said.

The suspect's phone was one of several devices that law enforcement investigators had collected as they worked to piece together a timeline of the assassination attempt against the former president during a Saturday rally.

"What is beginning to emerge is a portrait of a troubled young person who turned to violence," said John Cohen, an ABC News contributor and former head of intelligence at the Department of Homeland Security.

Cohen, who specializes in the phenomenon of mass shooters, added that investigators may never determine a single or precise motive for the attack. Sources familiar with the investigation have told ABC News that a search of the suspect's phone history has revealed no indication of Crooks’ political views or his motive for the shooting. Investigators have also found no digital footprint from the suspect suggesting any affiliations with international or domestic terrorist groups. They have also been unable to identify any ideological nexus to Trump and/or Biden, according to sources.

"Likely, it was a combination of mental health issues, ideological beliefs and a sense of personal grievance, the same combination of factors present in almost every school shooting and mass casualty attack over the past several years. As with those incidents, the warning signs were there, they were just not recognized," Cohen said. "The threat was real but people around him did not understand what they were witnessing or how it would play out last Saturday.”

The FBI early on Sunday had identified Crooks as the suspect. The U.S. Secret Service said snipers had killed Crooks at the scene. Firefighter Corey Comperatore, a dad who was attending the rally, was killed, and two other bystanders injured, officials said.

The searches compounded the questions that were swirling as investigators searched for a reason for the shooting, including a possible political motive. Crooks had been registered as a Republican voter, according to state records. But a $15 donation to a progressive group was also recorded under "Thomas Crooks" in January 2021, according to FEC records.

As investigators analyzed the suspect's phone, they looked at his search history, which included the queries for Trump and Biden. But that search history didn't immediately appear to reveal Crooks' political views, sources told ABC News.

Law enforcement officials investigating the assassination attempt told lawmakers on Wednesday that 20 minutes had passed between the time Secret Service snipers first spotted Crooks on a rooftop and the time the first shots were fired, according to several law enforcement officials and lawmakers briefed on the matter.

Meanwhile, House Judiciary Committee Chairman Jim Jordan, R-Ohio, wrote a letter to FBI Director Christopher Wray on Thursday requesting more information on the Trump rally shooting -- a preview of what GOP members on the committee may ask Wray when he appears at a hearing on Wednesday, July 24.

Jordan alleges that "whistleblowers have disclosed to the Committee that the U.S. Secret Service (USSS) did not have proper resources for President Trump's campaign event in Butler because of staffing shortages" due to the North Atlantic Treaty Organization (NATO) summit, which ran from July 9 to July 11 in Washington, D.C., and an event attended first lady Jill Biden in Pittsburgh on the same day as the Trump rally.

"The information provided to this Committee raises serious questions about the thoroughness of the security planning by local, state, and federal law enforcement agencies in support of President Trump's campaign rally," Jordan said. "Law enforcement overlooked a number of vulnerabilities prior to and during the event."

Editor's note: The story has been updated based on additional information from law enforcement.