At least 67 people were killed in the attack on the upmarket mall claimed by Somalia's Al-Qaeda-linked Shebab insurgents.
Ndegwa Muhoro, head of Kenya's Police Criminal Investigation Department, told reporters that investigations were still ongoing into exchanges of mobile telephone text messages in the days prior to the four-day siege that began on September 21.
"We wanted to arraign five of the terrorists in court yesterday, but we have decided to first investigate an SMS exchange of the terrorists which occurred on September 17," he said.
However, all gunmen -- totalling just four, not the dozen that security forces had initially reported -- are understood to have died during the attack.
Also Read
"Interpol is also assisting us in the investigations, including the analysis of four bodies suspected to be of the terrorists," Muhoro said.
A telephone call was made during the attack to Norway, he added.
A Norwegian citizen of Somali origin is suspected of being one of the attackers, a 23-year-old named by media as Hassan Abdi Dhuhulow.
Norway's PST intelligence agency has said it has investigated reports about the possible involvement of a Norwegian of Somali origin in both planning and carrying out the attack, but has declined to comment if Dhuhulow was involved.
The gunmen coldly executed scores of people, with witnesses recounting how in some cases they called out to those wounded, then finished them off at close range.
Meanwhile Kenya's army chief Julius Karangi said that two soldiers have been sacked for looting stores during the massacre, with a third under investigation.
Shop owners -- including a top end jewellery store as well as others selling mobile telephones, watches, cameras, expensive suits and lingerie -- said their stores were completely looted.