Mr. Shahzad, 30, a Pakistani-American who was naturalized as a United States citizen last year, has been charged with terrorism-related crimes and has waived his right to a speedy arraignment, officials said, meaning that he does not have to be brought to court right away. The government has said Mr. Shahzad admitted receiving bomb-making training in the tribal regions of Pakistan and then driving the car bomb into Times Square over the weekend.

The latest details about how investigators tracked him down add to a detective story worthy of a Hollywood movie. When New York police were alerted to the presence of the smoking Nissan Pathfinder and rendered it safe on Saturday night, they started out without any immediate suspects. The owner had evidently taken steps to avoid being identified, buying the vehicle with cash and apparently removing the visible vehicle identification number.

But after the police found the vehicle number on a hidden part of the engine, they tracked down the Connecticut woman who had sold it. While she did not remember the buyer’s name and had no paperwork from the sale, she did have the number of the phone he had used to contact her. That number led to a prepaid cellphone with no registered owner.

The authorities have said that phone received four calls from Pakistan in the hours before he bought the 17-year-old sport utility vehicle for $1,300. When they ran all the numbers tied to that phone through government databases, the only match they got was the number Mr. Shahzad had given when he returned to the United States on Feb. 3 on an Emirates flight.

Because he was coming from Pakistan, Mr. Shahzad was pulled aside for secondary screening upon arrival, the authorities said. After a Nigerian man tried to blow up a Northwest Airlines flight bound for Detroit on Dec. 25, the federal government mandated additional screening for all passengers arriving from 14 mostly Muslim countries, including Pakistan. That program has since been dropped in favor of a more selective screening system.