Timeline of Terror: How the Forest Park CTA Blue Line mass shooting on Labor Day unfolded

CHICAGO (WLS) -- The ABC7 I-Team has new information about how the CTA shooter managed to avoid detection as he carried out four executions on a moving train, in full view of onboard security cameras during the early morning hours of this past Labor Day.

Ex-security guard Rhanni Davis, 30, was charged Wednesday with four counts of first-degree murder. After court, Davis' public defender offered no comment.

ABC7 Chicago is now streaming 24/7. Click here to watch

Using information from law enforcement, prosecutors and transit officials, the I-Team has compiled the timeline of terror on that CTA Blue Line Monday morning as it was heading to west suburban Forest Park.

Prosecutors say Davis was first captured on CTA surveillance cameras Monday morning at approximately 3:50 a.m., boarding the CTA Red Line, and later transferring to the Forest Park-bound Blue Line train at around 4:30 a.m.

Forest Park police and Cook County State's Attorney's office records indicate Davis was seen in the footage carrying a black North Face messenger bag, and they allege he was also carrying a Glock 9mm pistol.

Around 5 a.m., onboard the CTA Blue Line train as it was passing through the area around Oak Park, prosecutors say the shooting starts.

Onboard, in-train surveillance cameras captured all four sleeping passengers being executed, cameras in two adjoining train cars as Davis walked through.

At 5:05 a.m., a timestamped surveillance footage clip at the Harlem Blue Line platform shows Davis exiting the train, and eventually walking through the station's turnstiles, appearing calm after the alleged deadly shootings.

Prosecutors said Davis "exited the station... then returned to the blue line about 15 minutes later where he boarded a train heading toward the loop."

According to a Forest Park police report on the mass shooting, the shooting victims were first reported to officials at 5:27 a.m.

That's around the time when CTA custodial staff at the Forest Park train station first discovered the victims, according to Forest Park police.

The report reads, "[A CTA employee] stated he began sweeping the entrance when he advertently swept a shell casing from [the] train onto the platform. [The CTA employee] stated he then observed the three victims sitting about the train, and alerted [another CTA employee] to the situation."

CTA officials told the I-Team they are unaware of any 911 calls being placed prior to the custodial staff's discovery.

That means four gunshot victims were left dead or dying for 22 minutes, from approximately 5:05 a.m. to 5:27 a.m., when the incident was first reported to police.

By 6:52 a.m. Monday morning, prosecutors say Davis was arrested at the California Pink Line stop at 2011 S. California, after a CTA employee noticed a person matching the suspect's description and notified police.

An official with the CTA told the I-Team that surveillance cameras inside train cars only record what's happening, and do not livestream or transmit what's captured in real time.

Video footage from inside CTA train cars must be downloaded from the train car itself, as Forest Park police noted doing during the course of the shooting investigation.

CTA officials noted that they do have security cameras on the train platforms that transmit live video in real time and are monitored by human eyes, but according to law enforcement records, those were of no help to four sleeping passengers once the train started moving away from the platform and the shooting started just before the Harlem Blue Line stop.

That train also had an empty conductor's booth, as has been the case for more than 25 cost-cutting years.

ABC7 police affairs consultant Bill Kushner told the I-Team the surveillance technology inside CTA trains may be in need of an upgrade.

"That's like 1980's technology," Kushner said. "You're going to record the event, but you're not going to be able to intervene in the event... Without the response component, it's useless. It's as good as a doorbell camera."

CTA officials say it would be a monumental task to live monitor inside all CTA train cars with real time security cameras.

Kushner believes only a narrow list of train cars may need monitoring in real time, based on routes and areas that have higher crime rates.

"Particularly on the problematic lines where they have the problems, like the Blue and the Pink Line, the Red Line out south," Kushner said. "Why not start with three lines and monitor those three sets of cameras where you know you have a crime problem?"

At a news conference on Tuesday, CTA President Dorval Carter Jr. addressed the need for transit riders to feel safe, and that the CTA is investing and upgrading its security capabilities.

"We continually invest in security, resources and measures, and have done so over the last decade, which includes the expansion and upgrade of our network of nearly 30,000 security cameras," Carter Jr. said.