Under French law, authorities can question Khazzani, who does not speak French, for four days, a deadline that expires Tuesday evening, after which they must charge or release him.
Witnesses said he opened fire, wounding a man before being wrestled to the floor and subdued by three young Americans — off-duty servicemen Alek Skarlatos and Spencer Stone and their student friend Anthony Sadler — and a Briton, 62-year-old business consultant Chris Norman.
A police source said they are hoping to glean information from the two phones Khazzani was carrying, one of which was only activated on the morning of the attack.
Khazzani was on the radar of European intelligence agencies, but gaps remain in his backstory.
A Spanish counter-terrorism source said he lived in Spain for seven years until 2014, where he came to the attention of authorities for making hardline speeches defending jihad, attending a radical mosque in Algeciras and being involved in drug trafficking.
His father said he left for France to work for mobile phone operator Lycamobile — a claim confirmed by the head of the firm who said Khazzani stayed for two months in early 2014 and left because he did not have the right work papers.
French intelligence sources, however, said Khazzani only came on to their radars in May this year, when German authorities warned he had boarded a plane for Turkey, seen as a possible sign that he travelled to war-torn Syria.
Khazzani is said to have told investigators he is “dumbfounded” by accusations he intended to carry out a terror attack.
He said he stumbled upon a weapons stash in a park in Belgium where he sometimes slept rough and decided to use it to rob passengers, according to Sophie David, a lawyer who was temporarily assigned to his case.
Khazzani's father has described his son as a “good boy” who preferred “football and fishing” to politics.
In the last six months, Khazzani has moved around Belgium, Germany, Austria, France and Andorra, David said.
Police have carried out searches at the homes of Khazzani's sister and one of his friends in Brussels, where he was believed to have spent several days, newspaper La Derniere Heure reported.
A prosecutor said nobody was arrested or questioned, but several items were removed for investigation.
'A message of hope'
President Francois Hollande told a gathering of French diplomats on Tuesday that France must prepare for further attacks.
“The aggression that took place on Friday… which could have degenerated into a monstrous carnage… is fresh proof that we must prepare for other attacks and therefore protect ourselves,” Hollande said.
He presented the men who subdued Khazzani with France's highest honour, the Legion d'Honneur, on Monday.
“You have shown us that, faced with terror, we have the power to resist. You have given a message of courage, solidarity and hope,” Hollande told them as he presented the medals.
Stone, who wore a sling to the ceremony due to the injuries he received to his hand, has also been nominated for the US Air Force's highest medal for non-combat bravery.
Speaking as he left the Elysee presidential palace after the ceremony, Norman said: “I think that one way or another, we are going to be facing this kind of problem quite a few times in the future, and I would invite you all to think about 'what would I do in that situation?'.
Sadler, 23, dismissed suggestions that Khazzani was not trying to kill anyone.
“It doesn't take eight magazines (of bullets) to rob a train,” he told reporters on Sunday.
Skarlatos added that if the attacker had known how to handle guns, he could have killed many people.