In establishing the total duration of planning, the FBI looked for evidence of behaviors that were observable (e.g., conversations, conducting surveillance) as well as in materials that were private to the active shooter (e.g., journals, computer hard drives) and likely unknowable to others until after the attack.