It has been more than a week since Nancy Guthrie’s disappearance from her Arizona home, and law enforcement continues to search for the 64-year-old mother of “Today” host Savannah Guthrie or anyone who may be responsible. Recent updates have renewed hope that Guthrie might be found, but so far those leads have not materialized into any public breaks in the case.
A man was detained in Rio Rico, Arizona, on Feb. 10 in connection with the abduction but was later released after questioning, according to The New York Times and Fox News. The man told Fox that he makes deliveries in the area.
Earlier that day authorities released security footage showing a masked, gloved, and potentially armed individual approaching Nancy Guthrie’s front door on the morning of her disappearance. Guthrie has been missing since Feb 1.
FBI Director Kash Patel posted on X that images showing “an armed individual appearing to have tampered with the camera” were recovered.
Investigators found a pair of black gloves on Feb. 11 during a search of the area around Nancy Guthrie’s home, law enforcement confirmed to KVOA, a local news station. The gloves have been submitted for DNA analysis according to the outlet. FBI agents were seen in Guthrie’s yard that afternoon.
Law enforcement has asked anyone with information to call 1-800-CALL-FBI, visit tips.fbi.gov, or contact the Pima County Sheriff’s Department at 520-351-4900 or 88-CRIME.
Here’s a closer look at what we know so far:
The footage bears a Nest watermark. An empty mount later seen attached to the doorframe appears to match one deigned for a Google product. It was previously reported that the footage was not accessible because Guthrie did not have a subscription.
Patel said in a social media post the video footage was uncovered after ongoing work with “private sector partners” to recover images from the home that may have been “lost, corrupted, or inaccessible due to a variety of factors – including the removal of recording devices. The video was recovered from residual data located in backend systems.”
Authorities have said the doorbell camera was disconnected at 1:47 a.m.
He announced the discovery of “previously inaccessible new images showing an armed individual appearing to have tampered with the camera at Nancy Guthrie’s front door the morning of her disappearance.”
Google, the maker of Nest cameras, did not immediately respond to a request for comment. On a Google Nest help page, it describes how it records video with various plans.
The person of interest, wearing disposable gloves and a backpack, can be seen tampering with the camera before stepping away.
How did the FBI get videos of the “person of interest”?
It’s likely that the images and video released by the FBI were part of a recording triggered by movement that was uploaded to Google servers temporarily, said Kelli Burgin, chairwoman of the cybersecurity department at Montreat College in North Carolina.
How did the FBI get videos of the “person of interest”?
It’s likely that the images and video released by the FBI were part of a recording triggered by movement that was uploaded to Google servers temporarily, said Kelli Burgin, chairwoman of the cybersecurity department at Montreat College in North Carolina.
“A lot of times the cameras are triggered by motion to record just a snippet. They don’t keep recording unless there’s more motion,” she said.
In order for users to access such cameras, she said, data is sent via WiFi connection to a Nest Google cloud server. “If you have a (storage) plan, it’s getting saved and categorized so that it’s accessible to the user,” she said.
If a user does not have a storage plan, which authorities have said Guthrie lacked, users can still watch a live stream on the phone app that still requires the data going first to a cloud server. But it’s typically overwritten after a period of time and is “not saved and categorized by subscriber, so that’s why it’s considered inaccessible.”
She said Patel’s statement that the video was located in “backend systems” likely refers to cloud servers, rather than it being on a phone or device.
Eric O’Neill, a former FBI counterintelligence operative, cybersecurity expert and author of the book “Spies, Lies, and Cybercrime,” said even without a subscription, doorbell video can exist in company’s servers briefly in what’s called transient storage—for processing, motion analysis and delivery to the app.
Cloud systems are also built for reliability, which means data is frequently replicated, logged, or buffered so it isn’t accidentally lost, he said. When a company says video is “deleted,” that usually means it’s no longer visible to the user, not that it’s been immediately erased. The underlying data can still exist until it’s overwritten, and that short window is often enough for investigators, working with the provider, to recover or reconstruct footage.
Kyung-Shick Choi, the director of cybercrime and cybersecurity at Boston University’s Metropolitan College, said such residual data can still remain in the server systems that store, process or temporarily cache video files and metadata.
“With proper legal authority, law enforcement can retrieve this residual data from those backend systems, which is what appears to have happened here,” Choi said.
That it took the FBI over a week to locate the footage doesn’t surprise Morgan Wright, a senior fellow at the Center for Digital Government who formerly worked in law enforcement. He said combing through data with digital tools takes time.
“It’s not as easy as people think,” he said.
Even so, Burgin said digital forensics tools can find data even after it’s been deleted. She has recovered data from hard drives that mistakenly got formatted, she said.
“Digital information is usually still out there, even if it’s been deleted or even if it’s been stored temporarily. Because, until it’s overwritten, it’s there,” she said. “That’s what a lot of people don’t understand. And with the proper forensics tools, you can recover a lot of data from hard drives or servers that is not necessarily accessible through the normal route.”
Wright, who formerly worked as a detective, said the video contains apparent facial features such as a mustache and that investigators should be able to calculate height, shoe size and brands of clothing.
Since police have said the home contained multiple cameras, Burgin said it’s possible there could be additional video found.
“I’m just hoping that by releasing that video, maybe they’ll have a break in the case where someone will recognize something,” Burgin said.
Pima County Sheriff Chris Nanos told reporters at a Feb. 5 press conference that the doorbell camera helped authorities piece together a new order of events for Guthrie’s kidnapping. She was first reported missing Sunday, Feb. 1, after concerned members of Guthrie’s church called her family to let them know that she had not attended morning services.
Nanos said they had been working with a tech company to recover the video, but had been unsuccessful. “We know that the tech company … they’ve run out of ways to recover that video,” he said. Asked if the doorbell camera was in police custody, Nanos said: “We do not have it in our possession, we did not locate it.”
