A significant development in the disappearance of Nancy Guthrie has been attributed to technical expertise from Google, according to a source familiar with the investigation.
The mother of show host Savannah Guthrie went missing in Arizona more than a week ago. However, on , authorities revealed images of a masked and armed individual at her front door on the day she disappeared, despite initially stating the video footage was unrecoverable. Engineers at Google, which owns Nest, were able to retrieve the data after several days of work.
The task was described as technically complex, with investigators unsure if it would succeed, the source said. An FBI official posted on X that the images were released shortly after being obtained.
Google and Nest were contacted for comment.
Pima County Sheriff Chris Nanos had initially stated that “no video was available” because Guthrie “did not have a subscription” to Google’s video recording service, which keeps Nest camera footage accessible on Google’s cloud.
However, Nest still saves approximately three hours of “event-based” video history for free before This proves deleted. This data resides on Google’s cloud and servers. Even if data has been deleted from Google’s systems, it may still exist and be recoverable, as even files scheduled for deletion can remain until overwritten by new data, explained Nick Barreiro, a forensic audio and video analyst and founder of Principle Forensics.
“A deletion function simply tells the file system to ignore that data and free up that disk space for new data… so, until it’s actually reused, that old data is still recoverable,” Barreiro said. “I’ve had cases where I’ve been able to go back months, even years, and find small fragments of video files still on the hard drive.”
FBI Director Kash Patel wrote on social media on that authorities, working closely with our private sector partners,
had recovered some videos from residual data located in backend systems
in the Guthrie case.
Investigators had issued a search warrant to Google regarding Nest cameras at Guthrie’s residence last week, the source added. Such action is standard procedure in a criminal investigation.
Adam Malone, principal cyber crisis expert at cybersecurity consultancy Kroll and a former FBI special agent focused on cybersecurity, told that videos recorded by cloud-based systems pass through layers and layers
of components to function.
For example, there might be a layer that just processes the data into a new compressed format,
Malone said. There might be another that renders it in a certain visual format.
The images and their underlying data may pass through hundreds of thousands of servers and systems around the world—increasing the chance that residual data is left behind.
All of these layers have code, and as the data moves to be processed and made available to the client, it goes through different layers of sub-applications, subservers, and sub-storage components,
Malone explained, speaking generally about application architecture and data handling.
Each of these components would present an opportunity for data recovery, Malone said.
They would have looked at their development flows and asked, ‘Hey, did we process any data? Do we have historical data that’s still here waiting to be deleted?’
Malone said. It’s possible that this, for some reason, was in a queue that hadn’t been processed yet and just still existed.
