CNN  — 

The shooter who attempted to assassinate former President Donald Trump on Saturday normally would have been at work that day, but he told his boss he needed that the day off because he had “something to do,” according to multiple law enforcement officials.

Thomas Matthew Crooks told his coworkers he would be back to work on Sunday.

While investigators have not been able to identify a motive for Crooks’ attack at the rally in Butler County, Pennsylvania, they are piecing together more of his activities.

By 3 p.m. on Saturday, roughly three hours before the shooting, Crooks was at the security screening area for the rally. He first aroused suspicion when he passed through the magnetometers carrying a?rangefinder, which looks similar to a small pair of binoculars and is used by hunters and target shooters to measure distances when setting up a long-range shot, according to a senior law enforcement official briefed on the investigation.

The rangefinder would not have prevented Crooks from getting through the security screening point, but it did attract the attention of security personnel who kept an eye on him until he left the secure area.

Investigators are unsure of where Crooks went after he left the screening area but the working theory is that he went to his car to retrieve the rifle.

Around the same time witnesses alerted police that Crooks was crawling on the roof of the American Glass Research building, one of the four counter-sniper teams observed Crooks looking at their position through the rangefinder, according to the senior law enforcement official.

“They were looking at him while he was looking at them,” the official said.

Crooks gained access to the rooftop by climbing on top of the building’s air conditioning system and hoisting himself up, according to a senior federal law enforcement official briefed on the investigation.

Around 11 p.m., Crooks’ father reported him missing, law enforcement officials told CNN. His father told agents that he believed his son had taken the rifle Saturday to go to the shooting range and thought he would be back by around 1:00 p.m., the sources said.

After the shooting, multiple law enforcement sources said investigators found a bulletproof vest, three fully-loaded magazines, and two remote-controlled explosive devices in Crooks’ car.

Investigators are uncertain as to whether Crooks had a plan to use the body armor, nearly 100 rounds of additional ammunition from those loaded magazines, and two remote-controlled bombs, had he escaped after the shooting.

Additionally, after a search of his residence, investigators discovered another bulletproof vest, another remote-controlled explosive device, and a 3D printer, according to multiple law enforcement sources.

In the last several months, Crooks received multiple packages, including some marked as possibly containing hazardous materials, according to a joint FBI and Department of Homeland Security bulletin obtained by CNN.

This story has been updated with additional information.

CNN’s Sean Lyngass contributed to this report.