Donald Trump’s lawyers found a box of White House schedules, including some that were marked classified, at his Mar-a-Lago resort in December because a junior aide to the former president had transported it from another office in Florida after the FBI completed its search of the property, according to two sources familiar with the matter.

The former president does not appear to have played a direct role in the mishandling of the box, though he remains under investigation for the possible improper retention of national security documents and obstruction of justice.

Known internally as ROTUS, short for Receptionist of the United States, the junior aide initially kept the box at a converted guest bungalow at Mar-a-Lago called the “tennis cottage” after Trump left office, and she soon took it with her to a government-leased office in the Palm Beach area.

The box remained at the government-leased office from where the junior aide worked through most of 2022, explaining why neither Trump’s lawyer who searched Mar-a-Lago in June for any classified-marked papers nor the FBI agents who searched the property in August found the documents.

Around the time that Trump returned to Mar-a-Lago from his Bedminsiter golf club in New Jersey at the end of the summer, the junior aide was told that she was being relocated to a desk in the anteroom of Trump’s own office at Mar-a-Lago that previously belonged to top aide Molly Michael.

The junior aide retrieved her work belongings – including the box – from the government-leased office and took them to her new Mar-a-Lago workspace around September. At that time, the justice department’s criminal investigation into Trump’s retention of national security documents was intensifying.

Several weeks after the junior aide moved into her new workspace, federal prosecutors told Trump’s lawyers in October that they suspected the former president was still in possession of additional documents with classified markings despite the FBI’s search of Mar-a-Lago on 8 August.

The Trump legal team subsequently hired two private contractors with security clearances to search Trump properties around Thanksgiving: Trump Tower in New York, Trump Bedminster and an external storage unit that turned up two additional documents marked “SECRET”, the Guardian has reported.

But the justice department was not satisfied, and it pressed the Trump legal team to get the contractors to conduct the third known search of Mar-a-Lago in early December – at which point the contractors discovered the box of presidential schedules, some with classified markings.

The Trump legal team alerted the FBI, which sent federal agents down to collect the box and its contents the following day.

A few weeks later, Trump’s lawyers started exploring whether they could get a better understanding of the sensitivity of the small number of schedules marked as classified, for the junior aide had kept sole custody of the box throughout that period.

It was at that point that the junior aide revealed for the first time that she could find out exactly what they were, because Michael – whose desk she inherited after she left the Trump political team at the end of the summer – had told her to scan all of the schedules on to her laptop.

A lawyer for the junior aide declined to comment on Thursday night.

When the Trump legal team told the justice department about the uploads, federal prosecutors demanded the laptop and its password, warning that they would otherwise move to obtain a grand jury subpoena summoning the junior aide to Washington to grant them access to the computer.

To avoid a subpoena, the Trump legal team agreed to turn over the laptop in its entirety last month, though they did not allow federal prosecutors to collect it from Mar-a-Lago and handed it over just outside the gates of the property.

It was later in January – as the justice department retrieved the laptop – that federal prosecutors in the office of the Trump investigation special counsel Jack Smith issued a grand jury subpoena for a manilla folder marked “Classified Evening Briefing” observed in the former president’s bedroom, the Guardian first reported.