Some Western security experts and officials saying they suspected it could be someone from the United States.
Officials say the breadth of topics addressed in the documents, which touch on the war in Ukraine, China, the Middle East and Africa, suggest they may have been leaked by an American rather than an ally.
"The focus now is on this being a US leak, as many of the documents were only in US hands," Michael Mulroy, a former senior Pentagon official, told Reuters.
Officials said the investigation is in its early stages and those running it have not ruled out the possibility that pro-Russian elements were behind the leak, which is seen as one of the most serious security breaches since more than 700,000 documents, videos and diplomatic cables appeared on the WikiLeaks website in 2013.
The Russian embassy in Washington and the Kremlin did not respond to requests for comment.
Following disclosure of the leak, Reuters has reviewed more than 50 documents labelled "Secret" and "Top Secret" that first appeared last month on social media websites, beginning with Discord and 4Chan. While some of the documents were posted weeks ago, their existence was first reported on Friday by the New York Times.
Reuters has not independently verified the authenticity of the documents. Some giving battlefield casualty estimates from Ukraine appeared to have been altered to minimise Russian losses. It is not clear why at least one is marked unclassified but includes top secret information. Some documents are marked "NOFORN," meaning they cannot be released to foreign nationals.
Two US officials on Sunday told Reuters they have not ruled out that the documents may have been doctored to mislead investigators as to their origin or to disseminate false information that may harm US security interests.
The White House referred questions to the Pentagon.
In a statement on Sunday, the Pentagon said it was reviewing the validity of the photographed documents that "appear to contain sensitive and highly classified material".
The Pentagon has referred the issue to the Department of Justice, which has opened a criminal investigation.
One of the documents, dated February 23 and marked "Secret," outlines in detail how Ukraine's S-300 air defence systems would be depleted by May 2 at the current usage rate.
Such closely-guarded information could be of great use to Russian forces, and Ukraine said its president and top security officials met on Friday to discuss ways to prevent leaks.
