He stops to buy 50 rounds of ammunition from the Allegheny Arms and Gun Works store five minutes’ drive from his home, then heads to retail giant Home Depot to purchase a 1.5m metal ladder. The long-haired bespectacled young man known as Tom appears to be an ordinary fellow going about his business this warm summer morning. He apparently does nothing to cause alarm or foreshadow the terrible plot running through his 20-year-old head.

It’s Saturday, July 13, and Crooks, a kitchen worker at a local nursing home, reportedly has called in sick, telling his boss he has “something to do” but confirming he will be back at work on Sunday. By all accounts he has had a busy few days.

He has driven an hour north to Butler to scope out the county fairgrounds where former president Donald Trump will visit in coming days. Crooks knows this because he used his phone to search for upcoming Trump dates, as well as the Democratic National Convention in Chicago in August.

The day before, Friday, July 12, he practised his shot at one of the numerous gun ranges at the 2000-member Clairton Sportsmen’s Club, a half-hour drive from his home. He already has hidden an improvised explosive device in his bedroom in the family home he occupies with his parents, Mary and Matthew.

And when he sets off on Saturday for the drive to Butler where Trump is due to speak later that afternoon, Crooks’ Hyundai Sonata is loaded with his father’s registered AR-15-style rifle, two radio-controlled home-made bombs and, according to US media reports, a bulletproof vest and three fully loaded magazines.

He leaves no obvious trail that may alert authorities to his intentions; no publicly available mes­sages or mainstream social media manifestos. There’s no whiff of dodgy associates or malign influences. He doesn’t appear to have a strong ideological bent – he’s a registered Republican voter who also gave $15 to a progressive political action committee the day US President Joe Biden was sworn into office in 2021. The introverted young man, described by a teacher as intelligent and well-spoken, wasn’t a known troublemaker and cleared background checks at the nursing home where he worked.

There seems to be nothing obvious in Crooks’ past to suggest what is ahead. Neighbours describe his parents as quiet and his older sister Katie, who lives independently in the Pittsburgh suburb of Bethel Park, as hardworking. He is not known to law enforcement and doesn’t have a criminal record.

But as Crooks parks his car outside the rally and heads toward the crowd he appears set upon the ultimate criminal act: the assassination of former president and now Republican presidential nominee Trump.

‘Someone’s on top of the roof. Look, he’s right there!” The male witness outside the Trump rally perimeter that Saturday afternoon is pointing to a nearby roof, encouraging other bystanders to notice the slim figure bear-crawling across the expanse and then settling on his stomach. “See him? He’s lying down.” The witness is not yelling and doesn’t seem unduly panicked. But he’s curious. Trump has just started speaking but the witness is distracted. What’s that guy doing up there?

It’s 6.09pm at Butler Farm showgrounds, Pennsylvania, home of the annual agriculture fair. The grounds are decorated with American flags and red and white Trump regalia; the blue-collar area, about 50km north of Pittsburgh, is a Republican stronghold and Trump’s well-worn mantras on immigration, manufacturing and Chinese imports resonate here.

Some of the faithful have been at the grounds in the 35C heat since 1pm and the atmosphere ahead of Trump’s appearance is festive. “Like an old-time rock concert,” is how retired emergency doctor James Sweetland describes it to local media.

No one seems to mind that Trump is late. He was due to start speaking at 5pm and an hour later he’s still not here, but the crowd is entertained by the pre-show prayer, national anthem, Pledge of Allegiance and warm-up speeches by Trump supporters. The former president’s favoured playlist, headed by the Village People’s YMCA, keeps energy levels high.

It’s believed Crooks parks his car well outside the rally area. He has hours to consolidate his plan and scope out the scene filled with thousands of Trump supporters.

The long-haired young man in his beige camouflage shorts and grey T-shirt with the logo of YouTube gun channel Demolition Ranch almost immediately draws attention. He looks suspicious. Several people notice him pacing near the security metal detectors at the entrance to the grounds. They’re concerned enough to alert local officers, who reportedly exchange photographs of him.

When Crooks walks through the metal detectors he’s found to be carrying a rangefinder, a device often used by shooters to measure distance. Security officials take note and he is deemed a person of interest but not a threat, a Secret Service agent later tells Fox News.

Security is highly visible – members of the Secret Service’s counter-sniper and counter-assault team are on site and four officers will later position on two roofs immediately behind the lectern. According to reports, at least a dozen police officers and sheriff’s deputies are here assisting the Secret Service and Pennsylvania State Police.

None of this appears to deter Crooks, who isn’t exactly skulking in the shadows. He appears to be hiding in plain sight.

Images taken an hour before Trump’s arrival shows a person matching his description pacing near the perimeter buildings.

By about 5pm, according to US media reports, police are aware of this man acting suspiciously and, as the clock ticks down towards Trump’s arrival, the sniper teams observe Crooks looking at their position through the rangefinder, a senior law enforcement official later tells CNN. “They were looking at him while he was looking at them,” the official says.

Crucially, in the minutes before the shooting, more witnesses spot Crooks perched on the roof of industrial equipment business American Glass Research outside the secure area. Local police are said to be stationed inside that same building, watching the rally crowd.

From his position on the roof Crooks has clear sight to the stage about 137m from where Trump moves to the podium at 6.05pm and begins speaking. Four minutes later, crowd-sourced video shows bystanders calling out: “Look, he’s right there,” pointing towards the roof. Others join in, alerting police 90 seconds before Crooks fires his first shot at 6.11pm. “Officer! Officer … He’s on the roof!”

In the background Trump can be heard in the early stages of his speech, marvelling at the size of the crowd (“I wish the fake news back there would show it”) and declaring that the country is going to hell.

Now more people are growing alarmed. Witness Greg Smith tells BBC News: “I’m thinking to myself: ‘Why is Trump still speaking, why have they not pulled him off the stage …’ ”

Smith says he and others outside the secure perimeter tried for “two or three minutes” to alert police before shots rang out. “We’re like, ‘Hey man, there’s a guy on the roof with a rifle.’ And the police were like ‘Huh? What?’ like they didn’t know what was going on.”

But police do know about the suspicious young man, they’ve been looking for him for at least 20 minutes. “So police responded to try to find the guy, searched the area but couldn’t find him, so said, ‘Well, let’s try the roof,’ ” Butler County Sheriff Michael Slupe later tells the media. One officer is hoisted up by a colleague to grab the edge of the AGR roof, causing Crooks to turn and point his rifle at him. The officer drops back down out of sight. “He doesn’t want to get killed,” Slupe says.

The sight of the officer hasn’t deterred Crooks but Butler Township commissioner Edward Natali says the encounter “most likely forced the shooter to hurry his shots”. Seconds later Crooks starts shooting.

It’s 6.11pm and Trump has been speaking for about six minutes. Video footage shows him pivoting to his right to refer to a chart showing immigration figures when a man in the crowd yells: “He’s got a gun! He’s on the roof!”

Initially some in the crowd think a firecracker has gone off. Others whip out their phones to video the growing chaos. Mike and Amber DiFrischia tell CNN later they first realised something was wrong when people started running.

Almost immediately three shots are heard and Trump, who is mid-sentence, grabs at his right ear and drops to the ground behind the lectern. “Get down! Get down! Get down!” a Secret Service Agent yells as more agents rush to protect Trump, hitting him so hard that his shoes fall off. (“And my shoes are tight,” he later tells the New York Post, saying the agents came flying in like “linebackers”.)

Snipers stationed on the roof behind Trump have already turned their sights to the gunman on the rooftop. Five more shots are heard. Twenty-six seconds after he opens fire, Crooks is dead.

At 6.12pm a male agent’s voice is heard: “Shooter’s down. We’re good to move.” Images shot by rallygoers show Crooks prone on the roof with armed agents standing over him. Trump later says they took him out “with one shot right between the eyes”. According to The New York Times, three videos posted on social media show that Secret Service snipers were already orienting themselves towards the gunman less than two minutes before Crooks started shooting.

As Trump is helped to his feet he’s heard saying “Let me get my shoes, let me get my shoes.”

“I got you, sir, I got you, sir,” the male agent says as another adds: “Sir, we’ve got to move to the car, sir.”

Then, with the instincts of a showman, a defiant Trump orders: “Wait, wait wait.” His ear is bloodied, his face streaked with red as he turns to the crowd, pumps his fists while mouthing the words “fight, fight. fight” as he is led away.

The crowd recovers and chants, “USA. USA. USA.”

In the bleachers behind Trump there are more screams and cries for help. Local father of two and volunteer firefighter Corey Comperatore, 50, has been fatally shot in the head while trying to shield his family from the gunfire. Retired doctor Sweetland rushes to help Comperatore. “I looked up and I saw what I assumed would be his wife and a daughter that were there, and the look on their face was something I’ll never forget,” he tells Associated Press.

Two other men, former US marine David Dutch, 57, and retiree James Copenhaver, 74, sitting on the bleachers are seriously injured.

Photographer Doug Mills, standing a few metres from Trump, unwittingly captured the round fired by Crooks. His defining image shows a streak of white smoke in the sky to the former president’s left. Trump later says he was saved by the simple act of looking to the chart, meaning the bullet wounded only the upper part of his right ear.

In an interview the following day with the New York Post, Trump’s ear is bandaged but he is otherwise well as he describes the “very surreal experience”.

“The doctor at the hospital said he never saw anything like this, he called it a miracle. I’m not supposed to be here, I’m supposed to be dead.

“By luck or by God, many people are saying it’s by God I’m still here.”

Thomas Matthew Crooks. An ordinary name for a young man from an ordinary middle-class suburb. What was behind his shocking actions that day and how was he able to get a clear shot at a former president? “It is surprising,” FBI special agent Kevin Rojek acknowledges.

Almost a week on from the shooting, very little is publicly known about the 20-year-old who left a surprisingly spare digital footprint.

A mobile phone was found on his body and officials have confirmed he used a cell phone to search for images of Trump and Biden along with other figures on both sides of the political spectrum, along with a member of the British Royal Family. He also searched for upcoming Trump appearances as well as dates for the Democratic National Convention.

Other reports allege he looked up “major depressive disorder” but officials in the early stage of the investigation reportedly found no indication of mental health problems. Officials have told CNN that the search history and significance of the photos are still unclear.

Crooks was a keen gamer so investigators are sifting gaming sites and encryption platforms. Fox News reported that a post on Steam credited to the gunman says: “July 13 will be my premiere, watch as it unfolds.” However, doubts remain over whether the account authentic.

The emerging picture is that some preparation went into the assassination attempt. Beside his body investigators found a transmitter believed to have been connected to the rudimentary bomb found inside Crooks’ car. Investigators speculated he planned to stage a distraction during the shooting, the New York Post reported.

The political interests of the Crooks family are also under investigation. Neighbours have reported seeing Trump or MAGA (Make America Great Again) signage in the family home’s front yard some time ago and the Associated Press claims that Crooks’ father, Matthew, was identified in a 2016 internal Trump campaign database as strong Republican, likely a gun owner and a “hunter”. His mother, Mary Crooks, was also identified as a likely gun owner.

It is unclear how accurate the modelling is because, according to CNN, Matthew Crooks is registered to vote as a Libertarian while Mary registered as a Democrat. Both are social workers.

Thomas was a member of the local gun club, the Clairton Sportsmen’s Club – hunting and target shooting are popular activities in western Pennsylvania. Officials have told NBC News that “more than a dozen” firearms were found in the family home (owners in Pennsylvania are not required to lock their firearms away).

According to media reports Matthew Crooks realised his son and an AR-style rifle were missing soon after the shooting and was worried enough to contact police. Speaking to CNN shortly after, Matthew Crooks said he was trying to figure out “what the hell is going on” but would “wait until I talk to law enforcement” before speaking about his son.

The family is co-operating as officials try to build a profile of the would-be assassin.

The Washington Post has reported that both parents have some health issues and while they were loving they were not particularly attuned to their adult son’s life.

Some have depicted Crooks as a loner who was relentlessly bullied at school, but Jim Knapp, who was Crooks’ guidance counsellor for his last three years at Bethel Park High school, says the quiet, intelligent and co-operative student had a small circle of friends. In his senior year he earned awards for maths and science.

“I know for a fact he wasn’t bullied in school because if he were I would have known about it,’’ Knapp told The Washington Post. Crooks’ older sister Katie worked in the school guidance office and their parents were involved in Thomas’s school life and were “very very nice”, he added.

After Crooks left high school he completed an associate’s degree in engineering science from the Community College of Allegheny County in western Pennsylvania. According to reports he earned high honours. One college instructor has told Reuters that she went back through his assignments this week, bewildered by the actions of a polite and thoughtful student who had always gone “above and beyond” in his work.

She says he excelled at an assignment to redesign a toy for disabled people. “He did a chess set for the blind. He 3D-printed it. He put the Braille on it … he really took a lot of care.”

Another staffer says he believes Crooks was interested in studying mechanical engineering and he planned to continue to his education at the Robert Morris University nearby.

Experts have warned investigators may never determine an exact motive. John Cohen, the former head of intelligence at the Department of Homeland Security told America’s ABC News: “Likely, it was a combination of mental health issues, ideological beliefs and a sense of personal grievance – the same combination of factors present in almost every school shooting and mass casualty attack over the past several years.

“As with those incidents, the warning signs were there, they were just not recognised. The threat was real, but people around him did not understand what they were witnessing or how it would play out.”

Beyond the motive of the would-be killer, attention has now turned to the security lapse that allowed Crooks to scale the building and get a clear shot at Trump.

America’s ABC News has quoted sources saying that instead of using a ladder, Crooks scaled an airconditioning unit accessible from the ground, pulling himself up to the top of a building outside the security perimeter. Investigators are pursuing the theory that he hid his rifle near the rally ground in advance.

The heat is on Secret Service Director Kimberly Cheatle, with top Republican leaders from both the House and the Senate calling for her to step down. Multiple investigations, including a congressional hearing, will be held into the entire security arrangements for the Trump rally to establish lines of responsibility.

Cheatle originally seemed to shift blame for the incident, telling US ABC News that local police were in the building at the time of the shooting and it was their job to secure the building, which was outside the perimeter secured by the Secret Service. “There was local police in that building – there was local police in the area that were responsible for the outer perimeter of the building,” she said.

She later softened her stance, telling CNN that protection for Trump was the responsibility of the Secret Service, acknowledging “the buck stops with me”.

“At that particular site, we divided up areas of responsibility, but the Secret Service is totally responsible for the design and implementation and the execution of the site,” she said.

Former agency officials and other security experts have argued that buildings with a direct sight line and within firing range of the former president should have been under constant surveillance by the Secret Service’s sniper teams. Wyoming senator John Barrasso told media the Secret Service spotted the attacker one hour before the attack but then lost sight of him. “He was identified as a character of suspicion because (he had) a rangefinder as well as a backpack. And this was over an hour before the shooting actually occurred,” he told Fox News.

“So, you would think over the course of that hour you shouldn’t lose sight of the individual.”

It has now emerged in media reports that sniper teams saw Crooks on the roof at 5.52pm, almost 20 minutes before the shooting.

Local officials have defended their response. Butler Township manager Tom Knights told media that local police informed the Secret Service two days before the rally that it would handle only traffic control. “All I know is our township police department was very clear that we did not have the manpower for it,” Knights said.

Mike Turner, a Republican congressman from Ohio, echoed the views of many when he told CNN it was “unthinkable, unfathomable” that the gunman could get so close to his target.

“Along with Donald Trump, our democracy dodged a bullet yesterday,” he said.