New York CNN  — 

NYPD investigators found a backpack in Central Park they believe belonged to the suspect in the killing of UnitedHealthcare’s chief executive, a law enforcement official told CNN.

Investigators have yet to officially confirm the origin of the bag and are taking it to be forensically tested in a lab in Queens, the source said.

Detectives earlier Friday said they have “reason to believe” the person responsible for the shooting has left New York City, according to police commissioner Jessica Tisch.

With the search for the shooter suspected of killing Brian Thompson now in its third day, the widespread manhunt is expanding and officials implore the public beyond the city’s borders to help them identify the suspect by taking a closer look at the unmasked man in the surveillance images released Thursday.

Tisch and Joseph Kenny, NYPD’s Chief of Detectives, sat down with CNN’s Shimon Procupecz to discuss the expanding investigation Friday. Here’s what else we’ve learned:

  • Police consider smiling photo of suspect to be the “money shot” that may help identify him.
  • Police have obtained video of the suspect entering the Port Authority Bus Station – but not exiting it, indicating he left town.
  • Authorities believe the suspect may have left New York City on an interstate bus.
  • Key evidence, including the bike the suspect rode and the gun used in the killing, is still missing.
  • The backpack was found in a second sweep of the park Friday evening between some boulders just south of the park’s carousel, according to a source.
NYPD
NYPD on Thursday released photos of a person of interest wanted for questioning regarding the Midtown Manhattan homicide.

Police in the area of Central Park where the backpack was discovered secured the area, bagged the piece of evidence and sent it, unopened, to the lab, the law enforcement official told CNN. It will not be opened until it reaches the lab.

An NYPD spokesperson confirmed to CNN a backpack was found in the park but said it “still has to be processed.”

Investigators are treating the discovery like a dead body, being very careful not to damage any potential evidence, a law enforcement official told CNN.

The backpack along with any physical material found surrounding it, was removed by an excavator, the source said. No officers picked it up, because there may be some DNA evidence tied to the backpack or even the dirt on the ground surrounding the backpack.

Investigators say the person they believe responsible for the killing “definitely planned this out.”

NYPD Chief of Detectives Joseph Kenny told CNN’s Shimon Prokupecz on Friday that the person of interest arrived in New York City ahead of the killing.

According to Kenny, there is video of the suspect about 30 minutes before showing him “walking and wandering around the hotel area before he committed this act,” he said.

“He knew what time the victim was going to be walking by. He knew what hotel this conference was going to be in,” Kenny said.

Investigators have so far recovered DNA evidence from items found at the scene and have turned it over to a lab for testing, according to a senior law enforcement official briefed on the investigation.

Samples sent for testing are from a water bottle, which police believe the killer purchased and may have sipped from shortly before killing Thompson, and from a cell phone found at the scene which may contain touch or skin cell DNA, the official said.

NYPD investigators finished processing the items and turned the samples over to the Office of the Chief Medical Examiner for testing Friday, the official told CNN.

The main priority for investigators is identifying the gunman, officials say. As the NYPD homicide unit works the case, the suspect’s image has been sent to every member of the department, officials told CNN.

The FBI is assisting the NYPD in its investigation, a bureau spokesperson told CNN on Friday.

The New York City Police Department’s video collection unit is building a trail of surveillance video sightings and canvassing for still images of the assailant’s face to load into their facial recognition technology, the official said.

A smiling surveillance photo depicting a hooded man –– a face mask pushed down around his neck –– may be a key clue leading police to the suspect in the fatal shooting.

The image released by the New York Police Department shows a man authorities call a “person of interest wanted for questioning” in the Wednesday morning killing. He is captured in a flirtatious moment with a female employee at a hostel on New York’s Upper West Side where he had been staying, a law enforcement official told CNN.

“He’s been traveling and walking around the streets of New York City largely in a mask, with his face covered,” Tisch said. “We had to go through lots of video evidence to get that one money shot with the mask down.”

The employee asked the man to lower his face mask, which is when the photos released by authorities on Thursday were captured, the official said.

“He lowers the mask, and gives that big smile,” CNN Chief Law Enforcement and Intelligence Analyst John Miller said. “That little flirtation between the two of them, in some good-humored way, actually yielded what is so far the most significant clue to identifying him.”

The hostel apologized for the presence of law enforcement and media in the area on a flyer posted inside the building Thursday night, a photo obtained by CNN shows.

“The well-being of our guests, volunteers, staff and all those at our property is our top priority, and our team is cooperating with the authorities who are handling the matter,” the flyer reads.

Niki Dilley, a 23-year-old tourist from New Zealand, checked into the hostel on Tuesday. Dilley is traveling with a friend and staying in a four-person room on the fourth floor. He said he never saw the person of interest, adding many people are going in and out of the building all the time.

Dilley saw one police officer on Wednesday night but was not interviewed. “It’s made for an interesting week,” he said, but has noticed no mass exodus of guests as a result. “It’s scary, but also cool,” he said of staying at the hostel.

“We are fully cooperating with the NYPD and, as this is an active investigation, can not comment at this time,” a spokesperson for the hostel previously told CNN.

Courtesy Niki Dilley
A flyer is seen at an Upper West Side hostel that a person of interest checked into.

Along with photos from the hostel, investigators continue to examine physical evidence including the burner phone and water bottle believed to have been dropped by the suspect when he fled the shooting scene – first on foot, then by bike – as well as recovered ammunition with the words “depose” and “delay” written on them, sources told CNN.

Kenny told reporters the words “delay,” “deny” and “depose” were scrawled on the ammunition, one word on each of three bullets, according to the Associated Press.

Authorities also have pieced together more about how and when the suspect got to New York City.

Now, the biggest challenge for the NYPD is tracing the movements of one person in a city populated with more than 8 million people, Andrew McCabe, a former FBI deputy director, told CNN Thursday.

Parent company adds security measures for employees

In the wake of the brazen attack, UnitedHealth Group, the parent company of Minnesota-based UnitedHealthcare, has laid out security plans for employees.

“We’re ensuring the safety, security and wellbeing of our employees,” said Andrew Witty, CEO of UnitedHealth Group in an email sent to employees on Thursday and obtained by CNN.

The health insurance company is fully cooperating with law enforcement as the manhunt continues, the email said.

“Several support mechanisms” are being put in place for employees, Witty said. “We have increased security at our campuses in Minnesota, in addition to sites in Washington, D.C., and New York City areas.”

No visitors are allowed on administrative campuses through the end of the week, Witty added.

How the suspect got to New York City

Video of the brazen killing –– carried out in full view of pedestrians in the busy Manhattan area –– helped investigators determine the suspect’s first moves after the shooting, police said.

The masked gunman waited for Thompson outside the Hilton Midtown shortly before 7 a.m. Wednesday then shot him multiple times before fleeing through an alleyway and getting on an electric bike. He was last seen at 6:48 a.m. headed into Central Park, New York police said.

Thompson, who lived in Minnesota and was on his way to the hotel to attend his company’s annual investor conference, was pronounced dead less than half an hour later.

New details are now emerging about the suspect’s movements in the days leading up to the shooting.

The suspected gunman traveled on a Greyhound bus that started its route in Atlanta, law enforcement sources told CNN. Authorities do not know whether the suspect boarded in Atlanta or elsewhere, sources said.

The Atlanta Police Department will provide assistance to the NYPD as needed in the investigation, department officials announced Friday. NYPD detectives are expected to come to Atlanta to help further the investigation into the gunman, two law enforcement officials briefed on the matter told CNN.

Police believe the assailant arrived at New York City’s Port Authority bus terminal on November 24 – 10 days before the shooting – then checked into the Upper West Side hostel, a law enforcement official said.

After that, he appears to have moved around the city, the official said.

The suspected shooter appeared to wear a mask throughout most of his stay at the hostel, law enforcement sources told CNN. He was housed in a multi-person room with two other males, one source said.

The suspect checked out of the hostel on November 29 and checked back in on November 30, law enforcement sources told CNN.

He paid the establishment in cash, according to one source –– checking into the hostel using a fake New Jersey driver’s license, a law enforcement official previously told CNN.

Christopher Hamel
Surveillance video appears to show the suspect in the United Healthcare CEO’s killing leaving the 57th Street F train station before the shooting. CNN has confirmed the timestamp at 6:15 a.m.

Clues from the crime scene

A shell casing recovered from one of the bullets fired at Thompson had the word “depose” written on it, while “delay” was written on a live round that was ejected when the shooter appeared to be clearing a jam, law enforcement sources told CNN on Thursday.

Police are exploring whether the words found indicate a motive, pointing to a popular phrase in the insurance industry: “delay, deny, defend.”

Police are still trying to determine where the suspect got the e-bike, however investigators are developing clues from the burner phone and water bottle believed to have been dropped by the gunman when he fled the shooting scene.

A fingerprint was lifted from the water bottle, a law enforcement official told CNN. The print, however, is smudged making it less conclusive, the official said.

The phone could yield fingerprints, DNA and –– if police technicians can unlock the phone –– other clues to the suspect’s identity, investigators said. Even a disposable burner phone might yield clues about communications and searches before the shooting. Police on Thursday afternoon were still trying to access that phone, a law enforcement official said.

Authorities have not found the gunman’s bike, weapon or backpack.

Spencer Platt/Getty Images
Police place bullet casing markers outside of a Hilton Hotel in Midtown Manhattan in New York, where United Healthcare CEO Brian Thompson was fatally shot on Wednesday.

A needle in a haystack

The suspect could have taken steps after fleeing to Central Park to evade detection, like changing into a different set of clothes, McCabe said.

Through Wednesday, police deployed mobile field forces to conduct a grid search, looking through garbage cans, dumpsters and bushes in an extensive search for a missing gray backpack, which the assailant was seen wearing during the shooting, a senior law enforcement official told CNN.

Police initiated the search after detectives reviewed security footage of the suspect no longer wearing the backpack after leaving Central Park through the West 77th street exit.

View this interactive content on CNN.com

CNN’s Meg Tirrell, Shimon Prokupecz, Amanda Musa, Linh Tran, Sara Smart, Taylor Galgano, David Goldman, Rebekah Riess, Ryan Young and Josh Campbell contributed to this report.