Actually I thought I heard them say they saw the one with the black cap first and it wasn't until later they put together the video and started to suspect white cap. I could be totally wrong about that though!
I think it was the opposite. Suspect 2 first because they saw the video of him leaving the backpack.