Authorities suspect that the man with a history of petty crime and drug dealing is the killer praised in the IS-linked Amaq news agency.
The Tunisian suspect in the Berlin truck attack, 24-year-old Anis Amri, was long watched as a potentially dangerous jihadist but managed to avoid both arrest and deportation from Germany.
Two days after the Christmas market rampage killed 12 people, Amri was named in European arrest warrants that offered a 100,000-euro ($104,000) reward for information and warned he could be "violent and armed".
Authorities suspect that the man with a history of petty crime and drug dealing is the killer praised in the IS-linked Amaq news agency as the "soldier of the Islamic State" behind the carnage.
Amri's asylum-office papers for a stay of deportation were found in the cab of the 40-tonne lorry that cut a swathe of death and destruction through the festive crowd.
The warrant said the dark-haired, brown-eyed and possibly bearded suspect had used six false names as he dodged security services and mingled with radical Islamist preachers, some of whom are now in custody.
He had already been in the crosshairs of counter-terror agencies, and a probe had been launched suspecting he was preparing "a serious act of violence against the state," said Ralf Jaeger, interior minister of North Rhine-Westphalia state.
The Berlin prosecutors, who were in charge of the case, said Amri had been suspected of planning a burglary meant to raise cash to buy automatic weapons, "possibly to carry out an attack".
Surveillance had then however shown that Amri was working as a small-time drug dealer in Berlin and once had a bar fight with another dealer, a statement said, adding that the surveillance had ceased in September.
Bild newspaper reported Amri had repeatedly contacted Islamist "hate preachers" including the Iraqi Ahmad Abdelazziz A., alias Abu Walaa, who has since been arrested, accused of supporting the IS.
Amri had searched for people to join him in an attack as early as the spring of 2016 and once tried to buy a pistol from an undercover police officer, an investigator was quoted as telling Bild.
He had used different identities to travel between German states, said an unnamed investigator, "but apparently there was never sufficient evidence to arrest him".
Amri's family lives in the central Tunisian town of Oueslatia, near Kairouan, a holy city of Islam which became a Salafist stronghold for a time after the 2011 revolution that overthrew long-time dictator Zine El Abidine Ben Ali.
A Tunisian security official told AFP that Amri had been arrested several times there for alleged drug use.
He fled Tunisia to Italy after the 2011 revolution. Media reports in Italy said Amri, then an unaccompanied minor, was jailed for several years there after being accused of starting a fire in a school.
Amri arrived in Germany in July 2015, at a time when tens of thousands of migrants and refugees also flocked to the top EU economy.
Germany rejected his asylum request in June this year but was unable to deport him as Amri claimed to have no travel documents.
His deportation then got caught up in red tape with Tunisia, which long denied he was a citizen. The documents only arrived on Wednesday, two days after the Berlin attack, said Jaeger.
"I can't believe my brother could do such a thing," his sister Najoua told AFP.
"He never made us feel there was anything wrong. We were in touch through Facebook and he was always smiling and cheerful."
His brother Abdelkader said: "When I saw the picture of my brother in the media, I couldn't believe my eyes. I'm in shock, and can't believe it's him who committed this crime".
But, he added, "if he's guilty, he deserves every condemnation. We reject terrorism and terrorists -- we have no dealings with terrorists."