Cho Seung-Hui walked into a Virginia gun shop five weeks ago and bought a Glock 19 handgun and a box of ammunition. He paid $571 (421 EUR).
The Glock was one of two guns found with Cho's fingerprints after he fatally shot 32 people and then himself at Virginia Tech in the deadliest shooting rampage in modern U.S. history.
Roanoke Firearms owner John Markell said his shop sold the Glock to Cho in March. The serial number had been scratched off, but federal agents traced it to the store using a receipt found in Cho's backpack.
"It was a very unremarkable sale," said Markell, who did not handle the sale personally. "He was a nice, clean-cut college kid. We won't sell a gun if we have any idea at all that a purchase is suspicious."
Markell said it is not unusual for college students to make purchases at his shop as long as they are old enough.
Cho was a legal, permanent resident, according to federal officials. That meant he was eligible to buy a handgun unless he had been convicted of a felony.
"To find out the gun came from my shop is just terrible," Markell said.
Authorities also found a Walther .22-caliber handgun in Cho's possession, according to a search warrant filed.
Because he killed and injured so many victims in a short span of time, some people speculated that Cho used high-capacity magazines containing as many as 33 rounds in each clip.
Under the federal assault-weapons ban enacted in 1994, magazines were limited to 10 rounds. But that ban was allowed to expire in 2004.
"The key thing that we have seen in all of these school shootings is easy access to high firepower weapons," said Daniel Vice, an attorney with the Brady Campaign to Prevent Gun Violence. "These killings can't be done with baseball bats and knives."
Under Virginia law, state police keep records of gun purchases from licensed dealers for only 30 days. After that, police destroy the records.
Fairfax County spokeswoman Merni Fitzgerald said there was no record of Cho applying for a concealed-weapon permit there.