Sept. 11: A woman calls and tells detectives she used to date Estep and is "sure'' he's the attacker, even though she hasn't seen him in years. The woman provides his full name and date of birth. Detectives check for an arrest history and don't find any. However, Estep was listed as a witness in a Chicago police report from 2014. The report includes a phone number, his physical description and a Michigan driver's license number. Detectives begin searching online for information about Estep and find him on the popular wedding website "The Knot,'' which showcased several pictures of him and information about his upcoming marriage. They bear a "direct resemblance" to the CTA surveillance photos, according to a police report.