WASHINGTON, D.C. – The first waves of arrests in the deadly siege at the U.S. Capitol focused on the easy targets. Dozens in the pro-Trump mob openly bragged about their actions on Jan. 6 on social media and were captured in shocking footage broadcast live by national news outlets.

But six months after the insurrection, the Justice Department is still hunting for scores of rioters, even as the first of more than 500 people already arrested have pleaded guilty. The struggle reflects the massive scale of the investigation and the grueling work still ahead for authorities in the face of an increasing effort by some Republican lawmakers to rewrite what happened that day.

Among those who still haven’t been caught: the person who planted two pipe bombs outside the offices of the Republican and Democratic national committees the night before the melee, as well as many people accused of attacks on law enforcement officers or violence and threats against journalists. The FBI website seeking information about those involved in the Capitol violence includes more than 900 pictures of roughly 300 people labeled “unidentified.”

Part of the problem is that authorities made very few arrests on Jan. 6. They were focused instead on clearing the building of members of the massive mob that attacked police, damaged historic property and combed the halls for lawmakers they threatened to kill. Federal investigators are forced to go back and hunt down participants.

The FBI has since received countless tips and pieces of digital media from the public. But a tip is only the first step of a painstaking process — involving things like search warrants and interviews — to confirm people’s identities and their presence at the insurrection in order to bring a case in court. And authorities have no record of many of the attackers because this was their first run-in with the law.

“Most of these people never showed up on the radar screen before,” said Frank Montoya Jr., a retired FBI special agent who led the bureau’s field offices in Seattle and Honolulu. “You watch the movies and a name comes up on the radar screen and they know all the aliases and the last place he ate dinner, all with a click of a button. Unfortunately, that’s not how it is in reality.”

The FBI has been helped by “sedition hunters,” or armchair detectives who have teamed up to identify some of the most elusive suspects, using crowdsourcing to pore over the vast trove of videos and photos from the assault. Forrest Rogers, a business consultant who helped form a group of sedition hunters called “Deep State Dogs,” said the group has reported the possible identities of about 100 suspects to the FBI based on evidence it collected.

Sometimes, a distinctive article of clothing helps the group make a match. In one case, a woman carrying a unique iPhone case on Jan. 6 had been photographed with the same case at an earlier protest, Rogers said.

“It’s seeking justice,” he said. “This is something that’s unprecedented in the history of our country.” Rogers asked, “Where else have you had several thousands of people who commit a crime and then immediately disperse all over the United States?”

John Scott-Railton is a senior researcher at the Citizen Lab at the University of Toronto who has been collaborating with journalists and others to identify suspects using digital clues. He said that while much is known about the “small fish” who committed crimes that day, a deeper understanding is needed of the actions of organized group leaders.

“We all need to be in a place where we can have conversations about what Jan. 6th was that go beyond a bunch of individuals motivated by a set of ideologies who showed up at the Capitol,” he said. Those being sought include many accused of violent attacks on officers. One video released by the FBI shows an unidentified man attacking officers with a baton. In another, a man is seen ripping the gas mask off an officer who screamed in pain as he was being crushed into a doorway by the angry mob.

In some cases, social media platforms have turned over incriminating posts that defendants tried to delete after their gleeful celebrations of the siege gave way to fears of being arrested. Often, the attackers’ own family, friends or acquaintances tipped off authorities.

In one case, the FBI used facial comparison software to find a suspect on his girlfriend’s Instagram account. Agents then went undercover, secretly recorded the man at work and got him on tape admitting to being in the crowd, which he described as “fun.”