GREENWOOD, Ind. — Authorities are working to learn more about the suspected gunman and any possible motive behind Sunday’s mass shooting at the Greenwood Park Mall.

The Greenwood Police Department confirmed that around 6 p.m. Sunday a lone suspect exited a restroom, where he was for more than an hour before the shooting, based on surveillance video, and entered the food court, where he opened fire, killing three people and injuring two more.

According to authorities, 30-year-old Victor Gomez was just outside of the restroom when he was shot. Police found that Gomez was carrying a handgun, but the shooting happened so fast, he never had the chance to use it.

Police said the other two other victims killed, married couple Rosa Mirian Rivera de Pineda, 37, and Pedro Pineda, 56, were eating dinner when the gunman pointed a Sig Sauer M400 semi-automatic rifle into the food court, shooting them.

“I was in disbelief. I’m like, they’re like two of the most caring people you could ever meet. They were so nice and stuff,” said Oscar Maldonado, who used to live next door to the couple for many years and described them as kind and humble.

In total, police said the attack lasted 15 seconds from when the shooter began firing until a 22-year-old man being hailed a hero, was able to shoot and kill the suspect. Police have identified him as Eli Dicken, of Bartholomew County.

“The real hero of the day was the citizen that was lawfully carrying a firearm in the food court and was able to stop the shooter almost as soon as he began,” Greenwood Police Chief James Ison said.

According to surveillance footage, Ison said the suspect exited the restroom at 5:56:48 p.m. and began firing. It was at 5:57:03 p.m. where police said he had been “neutralized.” During a press conference on Monday, officials said Dicken fired 10 times.

Results of an autopsy report shared by the Johnson County Coroner’s Office show that the suspect was shot eight times, none of which were self-inflicted.

Armed only with a handgun, police say Dicken engaged the shooter from a distance of perhaps 30 yards. Police say he was very proficient and tactically sound, even motioning for people to leave behind him as he made his way towards the gunman.

Two other victims, a 22-year-old woman who was shot in the leg, and a 12-year-old girl, who was hit by shrapnel, were injured in the shooting and survived.

On Monday, officials with the Greenwood Police Department, Johnson County Sheriff’s Office, Federal Bureau of Investigation (FBI), Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), IMPD, Johnson County Coroner’s Office and Greenwood Fire Department met to discuss the investigation.

During the press conference, officials provided more specific details, including a timeline of events from when the gunman entered the mall, until he was taken down by a bystander.

Police said in addition to the semi-automatic rifle used in the shooting, a second rifle belonging to the suspect was also recovered at the scene, along with more than 100 rounds of ammunition and several magazines. On the suspect, police said a handgun was also recovered.

Where does this investigation go from here?

There are still a lot of questions that investigators are working to get to the bottom of, including perhaps the biggest one: why did the accused shooter carry out this attack?

On Monday, Ison said, “Right now we have no motive. Family members we spoke to, they were just as surprised as everyone else was. They said there were no indicators that he was violent or unstable.”

Investigators are also working to determine what the suspect was doing in the bathroom for more than an hour prior to the shooting.

“The most puzzling piece of this puzzle is the fact that he was in that restroom for an hour and two minutes. We believe, and we don’t want to speculate, but we believe he was getting ready. He had a waistband holster on with several magazines, he had a backpack that had a second rifle broken down in it so it would fit in there, several rounds of ammunition, so we believe he was kind of preparing for his actions during that hour and two minutes,” said Ison.

CEO of Veracity IIR and former FBI agent, Doug Kouns, said there will be a lot of work investigators will have cut out for them from here. He is not involved in this investigation, but based on experience, was able to provide insight into how these types of investigations work and next steps that authorities will likely take.

“There’s a lot to do. Obviously in this one you can’t talk to the subject, unlike the July 4 shooter where they do have [a] live subject that they can talk to and interrogate and get those answers from directly,” explained Kouns.

He said investigators will need to take a more indirect route as they work to get answers on any potential motive.

“So, part of that is crime scene, it’s the search warrants that they serve at his apartment or wherever he was living, the laptop or computers that they find in those searches, and then search the hard drives for browser history and other activities,” said Kouns.

Kouns also explained that investigators will work to speak to people who know the suspect, including anyone from friends to classmates, teachers, coworkers, bosses, etc. Who investigators speak with would vary based on the investigation and suspect, but conversations could help investigators determine whether anyone else had information on this before it happened or answer other questions about the accused shooter.

Officials confirmed during Monday’s press conference that the suspect’s family is cooperating with the investigation.

When asked how long an investigation like this could take, Kouns said there is no one-size-fits-all answer.

“It just depends. There’s not a good answer for that,” he said. “What you don’t want to do as an investigator is to jump to a conclusion.”

Authorities have said that all three victims killed were Latino, which prompted the question during Monday’s press conference over whether the shooting may have been targeted. Police said there was no evidence at this time to support that, however, Kouns said it will be something that investigators will look into.

“I read that also that the victims had Hispanic names and it crossed my mind, so you kind of file back there and as you do your investigation you try to answer that question, was this racially motivated? If you can eliminate it, you move on and look for the next thing, but perhaps when they get into the computer or social media, we’ll see some clues about what his ideas are on race, religion, politics all of those kind of things, often the motivator for these kinds of things,” said Kouns.

In addition to a backpack with ammunition, police said they recovered two other guns and the suspect’s cell phone from the scene. Forensic investigators are hoping to uncover information from the phone.

“Throwing the cell phone in the toilet is not going to damage it significantly enough for forensic experts to not extract that data,” said Kouns.

Police raided the apartment of the suspected gunman hours after the shooting. There, officers found a laptop inside an oven that was at a high temperature. A can of butane was also found in the oven, authorities confirmed.

The raid at the suspect’s residence at Polo Run Apartments early Monday morning also included SWAT teams, FBI and a bomb disposal unit.

“I don’t want to speculate what his intentions were whether it was to cause a fire or damage the laptop, but we did retrieve the laptop and that is going to go to Quantico to be analyzed. It’s been damaged due to the heat in the oven,” Ison said during Monday’s press conference.

As Kouns explained, investigators will work to analyze the laptop and extract any data they can retrieve.

“It’s very hard to completely eliminate the evidence that’s on a computer. That hard drive that’s in there would have to be pretty well physically destroyed for there to be nothing,” said Kouns.

We asked Kouns whether it raises a red flag to know that the two electronic devices were found submerged in water and in an oven left on a high temperature.

“You would assume there’s something on there that he does not want found,” Kouns said.

On top of analyzing the devices themselves, Kouns said investigators will also work to determine whether the suspect had social media and if anything was posted on those sites that could shed more light into the shooting.

“In general, it’s a very valuable tool for law enforcement. People post their thoughts on social media and sometimes people are even more bold from the safety of their computer screens at home,” Kouns said.

If a social media account is public, it doesn’t require a search warrant, said Kouns. However, if it is private or set where only friends or specific contacts can see it, Kouns said a court order would be required to be served to that social media provider to get the content.

“You’re still going to get it, it might just take you a little bit longer,” he explained.

Although investigators initially said they did not believe the shooter had a social media presence, Kouns said a deeper dive by investigators would take a look at all of the places a person could have an account.

We asked, what if a person uses an account under a fake name? As Kouns explained, technology is more advanced than you think — and so are the investigators trained to navigate it.

“Often you have to sign up, now you can use fake information. But one thing that’s not fake that people don’t often think about is their IP address. The computer that you used has its own signature and experts can use that to figure out where it came from,” said Kouns.

Kouns said federal investigators will work with local authorities on the determination of where the guns came from, how they were purchased, and other parts of the investigation related to the firearms.

At this point, officials confirmed that both rifles recovered at the scene belonging to the suspect, were purchased by the suspect in Greenwood. The semi-automatic rifle used in the shooting was purchased in March 2022, investigators said, while the other rifle recovered was purchased in March 2021.

No information has been provided regarding where the pistol recovered on the suspect was purchased, when, or whether it was bought by the accused shooter.

“There’s possibility that there is more to come from this but clearly the main person responsible is deceased,” said Kouns.

You can read more on the investigation, as released by authorities, by visiting this link.