NewsWe Follow Through

Actions

How did the FBI recover footage from Nancy Guthrie's doorbell camera?

Nikolas Behar, an adjunct professor of cybersecurity at the University of San Diego, breaks down the complex process
How did the FBI recover footage from Nancy Guthrie's doorbell camera?
Posted

SAN DIEGO (KGTV) — Tuesday marked a major turning point in the search for Nancy Guthrie when law enforcement shared images recovered from her front doorbell camera — a moment that seemed almost impossible after they said there was "no video available."

The breakthrough came when the FBI released images recovered from Guthrie's doorbell camera, showing a person at her front door wearing a mask and a backpack, armed with a gun, and tampering with her surveillance system.

nancy guthrie nest camera

Guthrie had a Nest camera owned by Google. On the night of her disappearance, investigators say it was disconnected at 1:47 a.m. on Feb. 1 and detected motion 25 minutes later. Pima County Sheriff Chris Nanos initially said there was "no video available."

Nikolas Behar, an adjunct professor of cybersecurity at the University of San Diego, said, "(Nancy) did not have a subscription, a premium subscription, so it was not maintaining any images stored anywhere, or at least that's what they said."

When Behar isn't teaching class, he's a professional hacker who tests security systems for banks and hospitals. He explained how the recovery was possible despite the initial assessment.

"Even when you don't have a subscription, it's still taking very quick clips every time there's motion. Those get stored temporarily somewhere on the backend," Behar said.

CNN reports the FBI sent a search warrant to Google last week to retrieve the footage. These previously inaccessible images were shared just hours after they were discovered, but came eight days after the FBI began working with private sector partners, according to FBI Director Kash Patel.

ABC 10News asked Behar why that discovery process takes so long.

"So we know that a lot of devices that were there lost power. And so, when a device loses power, everything that's stored in its memory, which is volatile, gets erased. So they had to go back and use forensic techniques to recover things from devices there as well as using forensic techniques to recover things from the back end servers of the doorbell company," Behar said.

Those techniques are now reshaping the entire investigation into Guthrie's disappearance.

Hours after those images were released, police and the FBI detained a person in connection to Guthrie's disappearance.

They said the individual was taken into custody during a traffic stop in Rio Rico, south of Tucson near Arizona's border with Mexico.

Law enforcement is not calling that person a suspect, and have not said whether it's the same person captured on the doorbell camera.

Follow ABC 10News Anchor Max Goldwasser on InstagramFacebook, and Twitter.

This story was reported on-air by a journalist and has been converted to this platform with the assistance of AI. Our editorial team verifies all reporting on all platforms for fairness and accuracy.