Scientists searching for a toxic strain of E. coli that has raced across 25 states, sickening 121 people and killing one, have been able to identify the general source as the Yuma, Ariz., growing region. But as the outbreak enters its second month, they still cannot find the contamination itself — it could be lurking in the area’s fields, water sources, harvesting equipment, processing plants or distribution centers.

Federal officials predict that the outbreak, linked to romaine lettuce, will continue for several weeks. It is the largest American E. coli flare-up since 2006, when tainted spinach sickened 199 people across 26 states. The current outbreak, and particularly obstacles to tracing it, underscore vulnerabilities in the monitoring of fresh produce.

“This is an era of big data and technology — we ought to really be able to find out which farm a bag of lettuce came from,” said Sarah Sorscher, deputy director of regulatory affairs at the Center for Science in the Public Interest, a consumer group.

Complicating the investigation is the fact that the romaine can come from a variety of farms and be commingled at points along the supply chain.

A federal law enacted seven years ago was intended to prevent such outbreaks — or at least to shut them down swiftly. But rollout has been slowed by wrangling over compliance costs and details, and the challenge of training tens of thousands of farmers and facility operators. Standards may not take full effect for years.

As a result, regulations developed to safeguard fresh produce delivered to schools, restaurants and grocery aisles nationwide are not yet enforced with inspections. For now, however, most farms do keep up with federal recommendations known as good agricultural practices, or GAP, submitting to voluntary audits that check whether produce is grown and packed to minimize risk.

In 2010 Congress passed the Food Safety Modernization Act, authorizing the Food and Drug Administration to work up comprehensive safety regulations. The F.D.A. largely finalized the standards in 2015, prodded by a consumer lawsuit to adhere to deadlines.

But the first inspections of the largest farms don’t begin until next year. Standards for farmers to monitor water supplies are still being fine-tuned, and are scheduled in stages through 2024.

Virulent strains of E. coli do emerge, but at least in beef, they can be neutralized by cooking. And beef products, identified by bar codes and lot numbers, are easier to trace than produce.

But leafy greens are usually eaten raw, heightening the likelihood that a dangerous strain like the latest one — Shiga toxin-producing E. coli O157:H7, which has caused kidney failure in some patients — will infect the consumer. Unlike products such as flour, lettuce’s shelf life is short: Opportunities to test the offending crop range from limited to nil. And because detailed reporting requirements to track produce from field to supermarket have not yet been hammered out, fine-tracing the source of contamination is exceedingly difficult.

Dirt Detectives

The initial alerts in this latest outbreak came from the Garden State.

On April 2, New Jersey Health Department investigators contacted officials at the Centers for Disease Control and Prevention. They were seeing a cluster of patients with E. coli infections.

“The first step in any of these large outbreaks is to understand we have a problem,” said Matthew Wise, deputy chief for outbreak response in the C.D.C.’s division of foodborne, waterborne and environmental diseases.

Within days, more states called in, having identified a common DNA fingerprint of the bacteria among their patients. The states uploaded their DNA reports to the C.D.C.’s database. On April 4, the C.D.C. contacted the F.D.A., which searches for contaminated products.

By April 5, the database indicated a multistate outbreak and by the next day, C.D.C. researchers were working up a uniform questionnaire for state health workers to interview patients. They quickly zeroed in on leafy greens.

“Leafy green outbreaks are difficult to solve,” said Dr. Wise, an epidemiologist. “A lot of times people don’t even know what type of lettuce they’ve eaten.” Realizing it had been mostly eaten in restaurants was a significant clue, he added. “Maybe it was coming in big bags of prechopped lettuce.”

Between the two agencies and state partners, a battalion of several hundred investigators threw themselves into the hunt.

Ultimately, the full measure of the outbreak will not be known. Usually only the sickest patients seek medical help. The C.D.C. estimates that for every case reported to the authorities, 20 to 30 more people fall ill from the same strain; about 128,000 Americans are hospitalized and 3,000 die each year from foodborne illnesses. In a nationwide outreach to clinicians, C.D.C. officials have emphasized that Shiga toxin illnesses should not be treated with antibiotics.

By April 13, the C.D.C. announced that 35 people from 11 states had become ill from the same strain of E. coli, now linked to romaine lettuce from the Yuma region of Arizona. F.D.A. investigators traced the sickness among a cluster of eight inmates at an Alaska prison back to whole-head romaine that had been harvested from Harrison Farms, in the Yuma area. But they could not link other cases to the same farm.

Harrison Farms is a member of the Arizona Leafy Greens Marketing Agreement, an organization of producers whose practices meet or exceed requirements established through the Food Safety Modernization Act, said Teressa Lopez, a spokeswoman for the group.

But it turns out that romaine is not romaine is not romaine.

It can be processed and distributed in many ways — chopped, cored, sold as hearts or even mixed with other greens in salad bags. The more processes, the more convoluted the trail. The scores of patients who became ill after eating romaine at restaurants had not consumed the whole-head product.

Dr. Stephen Ostroff, deputy commissioner for foods and veterinary medicine at the F.D.A., compared so-called traceback efforts to finding common points of intersection among flight paths on an airline magazine’s map. Step by step, investigators work backward from each known point of contact for a patient, sifting through menu items, individual recollections, bills of lading, distribution sites, chopping and bagging facilities, locations where lettuce is cooled, trucks and fields. It is rarely linear. Finding a needle in a haystack is a no-brainer compared with finding the source of the Shiga toxin-producing E. coli making its way around the country.

Officials say the bacteria almost certainly originated in the fecal material of an animal. But was it tilled into the soil? Found in farm animals? Did deer nibble and excrete their way at night through fields?

Or was the bacteria spread by any of the many ways water connects with fresh produce, including human hygiene practices?

Trevor V. Suslow, a postharvest quality expert at the University of California, Davis, who trains educators in the new compliance regulations, explained how the same water-involved practice used by two farmers could pose very different risks. Both might use crop protection sprays, he said. But one would fill farm tanks from a disinfected municipal water source, while another might draw from a pond or canal. “Same practice but very different risk profiles and potential for negative food safety consequences,” he said. Standardized training under the new act has been designed to highlight such risks.

The continuing investigation is focusing on the Yuma area, Dr. Ostroff said. The contamination, he added, “may be at several dozen farms. But we don’t know which farms. And it may not be that simple. The contamination may not have occurred at a farm but at a processor.”

The Yuma growing region includes some 230,000 acres of agricultural land, 23 cooling plants and nine facilities that produce bagged lettuce and salad mixes.

“We have to take into consideration every possibility,” Dr. Ostroff said.

Working Backward

The idea driving the new regulations, Dr. Ostroff said, is “to move the system from one that reacts when problems occur to working to prevent them in the first place.”

Because farmers are still receiving produce-safety training to prepare for when inspections of the largest farms begin next January, no one can say how effective these standards will be. The F.D.A. requirements include regular testing of water and manure used as fertilizer; the industry has discretion over how the testing is carried out.

Consumer groups say that rules streamlining record-keeping are as crucial to the program’s success as the hygiene and monitoring requirements.

“This outbreak highlights the important role that product-tracing has in an outbreak investigation,” said Sandra B. Eskin, director of the Safe Food Project at the Pew Charitable Trusts. “One of the reasons this investigation continues is that it’s been very challenging to trace lettuce back to a farm without an effective recording system.”

But that system does not seem to be imminent. “We will be engaging discussion with industry to identify ways to do better labeling and traceability of products,” Dr. Ostroff said. “It’s a work in progress.”