Everyone who applies for a US visa is additionally photographed and fingerprinted.
Everyone who applies for naturalisation is additionally photographed and fingerprinted.
The suspects did all three of these things. The US government has almost every foreigner legally on American soil in a database.
Plus then you have the DNV on top of that and or passport office.
http://www.cbsnews.com/8301-201_162-57580534/fbi-interviewed...
Dzhokhar had a Massachusetts driver’s license, and those pictures go into a facial recognition database.
Source: http://www.washingtonpost.com/world/national-security/inside...
--pre-submit thought: perhaps it was the older brother? Our background is rather limited but it would not be surprising if he had had prior run-ins with the law. Even a minor offense will get your mugshot in the file.
Funnily enough, if you download your information using Facebook's tools, you get a copy of your facial recognition data too. Presumably US law enforcement has access to that for their own uses.