The National Archives realized soon after Trump left office that documents were missing. They negotiated for nearly a year with Trump to get the first 15 boxes. When they realized that there were classified documents mixed in, they referred a criminal complaint to the DOJ which issued a subpoena for the rest of the documents that Trump was withholding. I believe that was in May. Then the FBI developed sources who told them there were more documents, so they got a search warrant and the rest is history.