“Hello red.” The message turns up again and again in a chat log the FBI pulled from Thomas Matthew Crooks’s Samsung phone, alongside strings like “Hdudhdbdbbd,” “Yolo” and “Jjjjjjjjjjjj.” Everything the other person wrote is blacked out.
That log is part of about 250 pages of FBI records Judicial Watch received last week through its Freedom of Information Act lawsuit over the Butler, Pa., assassination attempt. Within hours, headlines promised “mystery contacts” and a “mysterious chat thread with an unidentified person.” The timing gave them extra charge. On Sept. 15, President Trump posted that the shooting “was all a Democrat Plot, to get me out of the Election, that failed.” The same day, FBI Director Kash Patel told the Senate Judiciary Committee that “we found no evidence that that individual was literally even speaking to any other human being other than his parents.”
We read all 250 pages. They don’t settle the argument, but they say less than the headlines and more than the summaries. Most of all, they show what investigators were looking at in the first six days after the shooting, and how quickly some of those leads were checked.
The chat thread the FBI wanted to subpoena
The chat log is attached to a July 19, 2024, electronic communication from the FBI’s Pittsburgh field office, titled “Research of” followed by a redacted name. It covers a conversation between Crooks and one redacted correspondent from May 21, 2023, to Jan. 2, 2024. Crooks’s side is printed: greetings, the word “red,” keyboard mash and a few numbers. The other side is withheld.
Two details in the memo matter. The redactions over the incoming messages cite exemption (b)(7)(E), which protects law enforcement techniques and procedures, not the privacy exemptions used for names elsewhere in the file. And the analysts’ follow-up was about a website. The memo says a review of the site, whose name is redacted, linked it to the subject in an earlier case serial, and it recommends a subpoena to the site for any information about Crooks.
The memo doesn’t say who was on the other end, whether a person or an automated account sent the incoming messages, or whether the subpoena was ever issued. Neither do the other 249 pages.
Three “pertinent” conversations, and a negative check
The phrase “unknown contact” comes from a July 18, 2024, “Samsung Messaging Review” written by an FBI staff operations specialist in Baltimore. It covers messages on the phone from July 13, 2022, to July 13, 2023. Items “deemed pertinent” as of July 17 included three redacted conversations, from Dec. 12 to 26, 2022, Jan. 9 to 16, 2023, and Feb. 8 to 10, 2023. The same list includes DHL shipping notices, PayPal, Venmo and Samsung notifications, and campaign texts.
In this review, “pertinent” means the items were pulled into the extraction report for agents to look at. It isn’t a finding. The next paragraphs of the same memo show the first checks. A query for a redacted phone number in the Butler case file “yielded negative results,” and so did a query in Guardian, the FBI’s system for tracking threats and suspicious activity. Commercial records from Experian and an insurance claims database then tied the number to a person, whose name, birth date and address are redacted.
A separate “lead coverage” memo from July 19 lists Crooks’s recent and most frequent contacts in a table that is redacted. One partly legible passage refers to “the days leading up to the shooting” and to Monday, July 8, 2024. The rest of it is redacted.
The Warnock texts and the Hong Kong package
The “campaign-related text messages” are fundraising blasts. One reads, “Raphael knows how to win a Georgia runoff,” and asks for $40 toward a goal of $125,000 “in the next 10 hours,” with ActBlue donation links. Georgia’s Senate runoff was held on Dec. 6, 2022. Judicial Watch highlighted them in its announcement. The released pages reproduce the solicitations but don’t indicate a reply or a donation.
The DHL notices have drawn attention because they involve a shipment from Hong Kong. The texts describe a “PARCEL FROM HK” and say it was delivered on Tuesday, Jan. 3. The dates fit January 2023, inside the year the review covered and about 18 months before the shooting. Nothing in the pages describes what was shipped or links it to the attack.
The drone logs match what the FBI said in 2024
The most concrete material is the FBI laboratory’s report on Crooks’s DJI Air 2S drone. Examiners extracted 40 images, 20 of them lower-quality duplicates, and eight flight logs. The images date from Feb. 6 to Feb. 27, 2024, around Pittsburgh. Captions identify the Community College of Allegheny County, Allegheny Commons Park and the National Aviary.
The flight logs place four flights in the Bethel Park area from Feb. 6 to Feb. 13, two in Allegheny West from Feb. 20 to Feb. 27, and one in New Eagle on Feb. 27. The last log, FLY017, was recorded in the Butler area on July 13, 2024, at about 19:51 Zulu time. That is 3:51 p.m. Eastern, a little over two hours before the shooting.
None of that is new in substance.
FBI Director Christopher Wray told the House Judiciary Committee on July 24, 2024, that Crooks flew the drone about 200 yards from the stage for about 11 minutes, starting around 3:50 p.m. The lab report shows the logs behind that statement.
What the file can and can’t tell us yet
These are early working papers, written four to six days after the shooting, while agents were still sorting leads. They show the FBI flagging unknown numbers, checking them against its own databases, identifying their owners through commercial records and asking for a subpoena. They do not show where those checks ended.
The FBI’s later conclusions are public. In November 2025, Patel and Deputy Director Dan Bongino told Fox News Digital that the bureau had concluded Crooks acted alone after a global investigation. Patel repeated that to senators last month. The three redacted correspondents and the website in the chat-thread memo are not explained in anything released so far, though. Judicial Watch says the full file runs to about 75,000 pages and is arriving at about 500 pages a month.
Primary source: FBI production 9 in Judicial Watch v. Department of Justice, No. 1:25-cv-02216 (250 pages), including the chat-thread memo and the Samsung Messaging Review. Read them yourself. Full context: Judicial Watch’s announcement.
Thomas Crooks’s ‘Mystery Contacts’: What the FBI’s Own Files Show
Sources
- FBI records, production 9, Judicial Watch v. DOJ (released Oct. 2, 2026). Used for: the chat thread and its exemptions, the Samsung Messaging Review, the database checks, the lead-coverage memo, the Warnock texts, the DHL notices, the drone lab report.
- Judicial Watch, “New FBI Records Reveal Thomas Crooks’ Phone Messages, Drone Details” (Oct. 2, 2026). Used for: the lawsuit, the 75,000-page file and the release rate.
- ABC News, “Trump claims Butler assassination attempt was a ‘Democrat Plot’ without showing evidence” (Sept. 15, 2026). Used for: Trump’s post and Patel’s testimony.
- Washington Examiner, “Kash Patel says ‘no evidence’ Trump shooter Thomas Crooks spoke to anyone but his parents” (Sept. 15, 2026). Used for: Patel’s testimony.
- Fox News, “FBI concludes Trump shooter Thomas Crooks acted alone after unprecedented global investigation” (Nov. 21, 2025). Used for: the FBI’s lone-actor conclusion.
- Washington Examiner, “Wray confirms gunman flew drone over Trump rally site hours before assassination attempt” (July 24, 2024) and PolitiFact (Aug. 2, 2024). Used for: Wray’s drone testimony and his statement that no accomplices had been found.
- yourNEWS (Oct. 2, 2026), Trending Politics (Oct. 2026) and The Gateway Pundit (Oct. 2026). Used for: how the release was presented, including the Hong Kong shipment and “mysterious chat thread” and “mystery contacts” framing.