A derailment which left three people dead happened after the train struck a landslip covering the track, the Rail Accident Investigation Branch has said.
The driver, conductor and a passenger died when the 06:38 Aberdeen to Glasgow service crashed near Stonehaven.
The RAIB said the train had turned back towards Aberdeen after reports of a landslip further down the track.
The six-vehicle train had travelled more than a mile when it was derailed after hitting a separate landslip.
The track curved to the right, but investigators said the train continued in a straight line for about 100 yards before hitting the parapet of a bridge.
The locomotive at the front of the train continued over the bridge and fell down an embankment, as did the third passenger carriage.
The first passenger carriage came to rest on its roof, at right angles to the track, with the second passenger carriage on top of it.
The fourth passenger carriage remained upright and also came to rest on top of the first carriage. It was still attached to the rear locomotive.
Image copyright PA MediaThe RAIB said the train had left Stonehaven station and passed Carmont on Wednesday morning when it was stopped by a signaller who had received a report of a landslip further along the track.
The decision was taken to return to Aberdeen, and the train was routed back over a crossover at Carmont.
The RAIB said it was collecting evidence on the cause and consequences of the accident.
It will examine the sequence of events and the actions of those involved, as well as the management of earthworks and drainage in the area, including recent inspections and risk assessments.
Driver Brett McCullough, conductor Donald Dinnie and passenger Christopher Stuchbury died in the crash.
Image copyright Police Scotland Image caption Tributes have been paid to Brett McCullough, Donald Dinnie and Chris StuchburySimon French, chief inspector of the RAIB, said: "Thankfully, fatal derailments are a rare occurrence on the UK's national network.
"However, landslips and other earthworks failures remain a risk to trains that needs to be constantly managed - and this is becoming even more challenging for the rail industry due to the increasing incidence of extreme weather events."
It earlier emerged that an off-duty rail worker walked a mile to raise the alarm after surviving the accident.
Transport Secretary Michael Matheson told BBC Scotland's The Nine that a "number of actions" were taken after the derailment to raise the alarm.
He said: "There was a call made by someone who believed that an incident had taken place locally and they contacted Police Scotland.
"There was also an off-duty railway person on the train who, after it derailed, walked around a mile to the next signal box and advised them that an incident had occurred, which allowed Network Rail at its national control centre to close the line.
"During the course of that, Police Scotland obviously dispatched their staff and Network Rail dispatched some of the staff that they had working nearby to respond to the incident."
Image copyright PA Media Image caption Prince Charles visited the scene of the crash on Friday Image copyright PA Media Image caption The prince met emergency responders who were among the first on the scenePrince Charles thanked emergency responders for their bravery when he visited the site crash on Friday.
He met some of those among the first on the scene, including Pc Liam Mercer and Pc Eilidh McCabe.
First Minister Nicola Sturgeon said the "hearts of a nation" were with those affected.
Image copyright PA MediaUK Transport Minister Grant Shapps has asked Network Rail to produce an interim report by 1 September.
Network Rail said it would carry out detailed inspections of high-risk trackside slopes with similar characteristics to the site of the Aberdeenshire crash.
Dozens of sites across Britain will be assessed using in-house engineers, specialist contractors and helicopter surveys.
Scotland's Lord Advocate has asked Police Scotland, British Transport Police and the Office of Rail and Road, the independent regulator, to conduct a joint investigation into the accident.
This will run in parallel with the independent safety investigation being carried out by the RAIB.