We use small and moderate aftershocks of the 24 February 2004 Al Hoceima earthquake as empirical Greens' functions (EGFs) to retrieve the rupture history of the main event. The magnitude, depth, and geometry of faulting were estimated for the main shock and 20 small and moderate aftershocks (Mw between 3.9 and 5.2) computing moment tensor solutions. For the main shock, we obtain a moment magnitude of Mw = 6.3 and a nearly pure double-couple source (4% compensated linear vector dipole) with predominately strike-slip faulting. The preferred fault plane has a strike of N11¿E, a dip of 72¿, and a rake of -17¿. Fourteen aftershocks, having depths (¿4 km) and faulting geometries (¿11¿ for the strike of the preferred plane) similar to the ones found for the main event, were used as EGFs. Apparent source time functions (ASTFs) of the Al Hoceima event were retrieved at twelve regional stations using an iterative time domain deconvolution on the P waveforms. At each station, time functions are enhanced by stacking of the deconvolved waveforms for different EGFs. ASTFs show total durations of 5 to 6 s, two consecutive subevents separated by about 3 s, and only a weak effect of directivity. We further investigate the source history by inverting the set of ASTFs for the distribution of fault slip and rupture propagation. Two different source models were selected for presentation, one involving one single fault plane and the other involving two parallel fault planes. The two-fault model fits more accurately the observations and leads to a more plausible slip distribution. We estimate rupture dimensions of about 10 ¿ 10 km2 and 8 ¿ 8 km2 and moment magnitudes of Mw = 6.2 and 6.0 for the first and second subevent, respectively.