(CNN)Santino William Legan looked like an "average guy," said witness Julissa Contreras. He appeared older than his 19 years, but he didn't seem angry as he opened fire on innocent people at the Gilroy Garlic Festival in Northern California.
Legan dressed the part, said Contreras, who was standing about 20 feet from the gunman when he began firing a semi-automatic rifle into the crowd.
The 19-year-old opened fire at the outdoor festival at around 5:40 p.m. Sunday, according to Gilroy Police Chief Scot Smithee. Three officers shot him within one minute, killing him, the chief said, adding that the scene might have been bloodier if not for the quick response.
Contreras described Legan as "white ... under 6 feet. He was wearing tactical gear, had a baseball cap on, sunglasses, and he had a semi-automatic rifle. He was dressed for what he was there to do."
It was difficult to read the expression on his face, she said, but "he seemed very well-versed in what he was doing."
"And he seemed confident in his use of the gun."
Members of the band, Tin Man, who were performing when the gunshots erupted, said the gunman wore a green shirt with a gray handkerchief tied around his neck. He sprayed shots from side to side, creating pandemonium, the musicians said.
The big question: Why?
As authorities continue to investigate what led Legan to kill a 6-year-old boy, a 13-year-old girl and a man in his 20s -- while injuring a dozen others, ranging in age from 12 to 69 -- a mixed picture of the gunman is emerging.
While Legan's social media activity suggests he had xenophobic or racist tendencies, a neighbor said he and his family seemed like nice people. And where former classmates said he didn't stand out, a Gilroy High School employee described him as a troublemaker who was "difficult to manage" when he actually showed up for class.
It's Smithee's understanding that Legan legally purchased the SKS assault-style rifle July 9 in Nevada, the chief said. Though the teen is originally from Gilroy, a city of 48,000 people about 30 miles south of San Jose, police believe he had been living with family in Nevada, Smithee said. It's unclear how long he'd been back in California.
7-year-old boy on shooting: I thought I was gonna die 00:56
The FBI searched a residence in Walker Lake, Nevada, "believed to have been used by" Legan in the days prior to the incident, according to Mineral County District Attorney Sean Rowe. Several police cars were outside the home of Legan's father in Gilroy on Monday morning.
Another search warrant was served on a family house in Gilroy, and authorities have also searched the car Legan drove to the festival.
Witnesses reported seeing a second individual who has not yet been identified, but Smithee cautioned that witnesses have given different accounts so it's unclear if another suspect was involved.
"We know there's almost always never a second shooter" in these types of mass killings, said CNN law enforcement analyst Josh Campbell, a former FBI supervisory special agent.
The FBI Evidence Response Team from San Francisco has been processing the scene, along with the Bureau of Alcohol, Tobacco, Firearms and Explosives and various state and local police agencies.
Instagram posts hours before attack
An Instagram account, which was created four days ago under the suspect's name, posted two messages shortly before the attack.
One included a photograph of people walking around the Garlic Festival with the caption, "Ayyy garlic festival time Come get wasted on overpriced sh**."
The other, which included a photo of Smokey the Bear and a sign saying "Fire Danger High Today," stated: "Read Might is Right by Ragnar Redbeard. Why overcrowd towns and pave more open space to make room for hordes of mestizos and Silicon Valley white tw**s?"
A mestizo is a person of mixed descent, commonly white and Hispanic or white and American Indian.
MUST WATCH
Witness 'smelled the gunpowder' from Gilroy festival stage 01:11
"Might is Right," first published in the late 1800s, has been described as a white supremacist text that promotes anarchy while vilifying Christianity. The book calls Jesus the "true Prince of Evil" and says that the natural order is a world at war in which the strong must vanquish the weak and white men must rule over those of color.
This sort of talk didn't jibe with the impressions of some of those who had met Legan. Though she concedes she didn't know Legan well, neighbor Rosana Mendoza was surprised when she saw police arrive at the Legan family home late Sunday.
"They told me the suspect is three houses from our house. I said, 'What, this teenager? They are all very nice,'" she said.
She would see the parents walking or Legan and his brothers playing basketball or hanging out in the front yard.
"I would say, 'Hi,' to them. They are very nice kids. When I found out this morning, I was shocked. This is a quiet place," Mendoza said.
'A problem kid'
Josh Carman, who was a senior at Gilroy High School when Legan was a sophomore, said he knew Legan but "never had any classes with him or anything, so we never really got acquainted."
"He wasn't the type of person that everyone knew, but he didn't stand out as being too abnormal," Carman said.
Tanner Eastus, who will be a senior this fall, was at the garlic festival with friends. He concurred with Carman's assessment of the shooter.
Legan "seemed like a normal guy. I don't believe anyone expected anyone to do something like this, especially in Gilroy," he said.
A Gilroy High employee, though, said Legan had a history of conflict.
Festival shooting witness: 'This is a nightmare' 01:33
Speaking on condition of anonymity because he was not authorized to talk to the media, the employee said Legan "was a problem kid" who defied authority, smarted off to teachers and picked verbal fights with other students. He also had a spotty attendance record, the educator said.
"When he chose to come to campus, he was difficult to manage," the employee said. "He would want to have his way and things on his own terms."
Gilroy Unified Schools district had no comment on Legan's school record.
According to a property manager in Walker Lake, Legan moved into an apartment there in April. He paid one month's rent, but moved out in the middle of the night a few days later. The apartment looked untouched, the property manager said, adding Legan had indicated the location was too remote.
"He was used to internet that works, bars, restaurants," the property manager said, "but here there's no such thing."
What is not known
Police believe the shooting was "a random act, but we've got a long way to go before we can determine what his motivations were," Smithee said.
Craig Fair, a deputy special agent in the FBI's San Francisco field office, said the primary aim is to understand Legan's motivation, ideological leanings and affiliations.
As 30 members of the FBI's evidence recovery team comb the scene, nothing has been determined and nothing has been ruled out, he said.
Police: Shooting suspect was shot and killed 01:58
The fact that there were no security cameras installed at the festival is complicating the investigation, Smithee said.
It appears Legan cut through a fence near a creek to enter the event grounds in Gilroy, which could be an important piece of information for investigators.
That might mean the shooter was prepared and wanted to avoid security and metal detectors, said Campbell.
