Investigators Detail How They Recovered Nancy Guthrie’s Nest Doorbell Video of Masked Figure After Apparent Deletion
Investigators say they recovered Nancy Guthrie’s Nest doorbell footage by extracting residual data from Google’s backend—using provider retrieval of “lazy deleted” files and possible tamper‑retention features—despite Guthrie having no active subscription and the device going offline early Sunday. The recovered clip and stills show a masked (and reportedly armed) individual tampering with the front‑door camera the morning of her disappearance (security logs show the camera lost connection at 1:47 a.m. with a motion event at 2:12 a.m.); authorities, who confirm blood at the scene belongs to Guthrie and are treating the case as a kidnapping, have released the images but have not named any suspects amid multiple ransom‑style messages and an active FBI reward.
📌 Key Facts
- Investigators recovered previously inaccessible Google Nest doorbell footage by extracting residual/backend data from the provider’s systems even though the device had no active subscription; cybersecurity experts say providers use “lazy deletion” and may retain final tamper/motion clips for days, allowing recovery.
- FBI Director Kash Patel said the restored video shows an armed individual at Nancy Guthrie’s front door who appears to have tampered with the camera; authorities are treating that person as a “subject” but have not publicly named a suspect or person of interest.
- The doorbell camera reportedly lost connection at 1:47 a.m., registered a motion event at 2:12 a.m. and a pacemaker–phone link was lost at 2:28 a.m.; law‑enforcement and former detectives note the roughly 41‑minute window inside the home raises questions about familiarity with the house and inoperable interior cameras, and agencies caution that a motion log does not necessarily equal recorded video.
- Investigators confirmed the blood at the scene was Nancy Guthrie’s and are publicly characterizing the incident as a kidnapping, saying they believe she is still alive.
- Multiple ransom‑style communications have been received: the FBI says it is taking two emails seriously (including one sent to a local station) with an apparent second deadline, Savannah Guthrie acknowledged receipt and said "we will pay," while a separate message sent to TMZ demanding one Bitcoin has prompted skepticism from former FBI officials who call it possibly opportunistic or a scam.
- Search activity at the Guthrie property intensified: investigators returned to the neighborhood, searched a backyard septic tank, removed a roof‑mounted camera, towed a dark SUV from the garage, canvassed nearby gas stations for surveillance, and checked locations connected to Nancy’s recent contacts.
- The FBI has offered a $50,000 reward, launched expanded public outreach (including tip billboards), and the family has made repeated public pleas for Nancy’s safe return while investigators continue forensic processing and follow‑up work.
📰 Source Timeline (12)
Follow how coverage of this story developed over time
February 11, 2026
11:05 PM
How did investigators recover Nancy Guthrie's doorbell footage?
New information:
- FBI and Pima County Sheriff’s investigators say they recovered the Guthrie porch footage by extracting 'residual data located in backend systems' of her Google Nest camera, even though the device had no active storage subscription.
- Cybersecurity experts explain that Nest’s backend and internal storage use 'lazy deletion,' meaning clips for non‑subscribers are flagged for deletion but underlying files can persist for days and be recoverable by providers or law enforcement.
- Experts suggest Nest devices may use a tamper‑detection mode that, when a device goes offline after an apparent tampering event, could prompt Google to retain the final motion or tamper clip longer than standard free‑tier retention, even though this is not spelled out in consumer terms of service.
- Google’s own cloud‑storage documentation emphasizes options to protect against accidental or malicious deletion and support legal or regulatory compliance, and FBI Director Kash Patel publicly described turning to private‑sector companies to 'excavate material that people would think would normally be deleted.'
9:49 PM
Few leads in Guthrie investigation after 11 days, yet cases often break unexpectedly
New information:
- Clarifies that as of February 11, investigators have not publicly identified any suspect or person of interest, despite multiple ransom-style messages and surveillance footage.
- Notes that the man recently detained in connection with the Rio Rico search was released within hours, indicating that lead did not pan out.
- Adds expert commentary from former FBI profiler Mary Ellen O’Toole emphasizing the role of public recognition of the masked individual in solving the case.
4:33 PM
Ex-FBI official flags possible scam as third alleged Nancy Guthrie letter emerges
New information:
- A third alleged email tied to the Guthrie case was sent to TMZ, demanding one Bitcoin and claiming knowledge of the kidnapper.
- The demand amount in the latest message is similar to the FBI’s reward value, suggesting possible copy‑cat or opportunistic behavior.
- Ex‑FBI assistant director Chris Swecker publicly questioned the credibility of TMZ‑sourced communications, saying he senses 'a scam' and that none of TMZ’s material has yet panned out.
February 10, 2026
5:43 PM
Authorities release video of potential subject in Nancy Guthrie case
New information:
- FBI Director Kash Patel publicly confirmed recovery of 'previously inaccessible' video that shows an armed individual at Guthrie’s front door the morning of her disappearance.
- Authorities say the person appears to have tampered with the front‑door camera and is being treated as a 'subject' in the case, though not yet formally labeled a suspect.
- The Guthrie family reportedly told NBC’s Tom Winter they do not recognize the individual in the still images.
February 09, 2026
2:34 PM
Nancy Guthrie search enters 2nd week as deadline looms
New information:
- FBI now publicly says it is taking two emails seriously, including one that appears to be a ransom note with a second deadline set for later Monday, after an initial 5 p.m. Thursday deadline.
- Savannah Guthrie’s latest video message explicitly acknowledges receipt of the kidnapper’s alleged message and states, 'we will pay,' with the FBI spokesman confirming she was referring to a message sent to CBS’s Tucson affiliate KOLD on Friday.
- Investigators over the weekend increased their presence at Nancy Guthrie’s home, searched what appears to be a septic tank in the backyard, removed a roof-mounted camera, and towed a dark-colored SUV from her garage.
- CBS reports investigators are canvassing nearby gas stations for surveillance footage and have also been seen at the home of daughter Annie, where Nancy ate dinner the night before she disappeared.
- Local church services at St. Andrew’s Presbyterian included specific public prayers for Nancy’s rescue and new FBI-tip billboards have begun appearing in neighboring states with a dedicated phone number.
1:30 PM
Guthrie family pleads again for mother's release ahead of possible ransom deadline
New information:
- Savannah Guthrie and her siblings issued a fresh public video plea over the weekend directly to whoever abducted their mother, Nancy Guthrie.
- The family and investigators are working against what is described as a second ransom deadline set for Monday, though the specific terms of that deadline remain unclear.
- CBS reports that the FBI explicitly says it is taking this latest ransom letter seriously, underscoring that it remains part of the active investigation.
February 07, 2026
8:12 PM
41-minute timeline in Nancy Guthrie case raises red flags from ex-homicide detective
New information:
- Specific timestamps from the Pima County Sheriff’s Department: doorbell camera loses connection at 1:47 a.m., motion event at 2:12 a.m., pacemaker–phone link lost at 2:28 a.m.
- Law enforcement now discloses that the security system’s motion log does not equate to recorded video, leaving open the possibility that the 2:12 a.m. trigger was non‑human.
- Ex‑homicide detective Ted Williams publicly posits that remaining inside for roughly 41 minutes suggests the perpetrators were familiar with the home and with its inoperable interior cameras.
6:05 AM
What to know about Nancy Guthrie's kidnapping and the race to find her
New information:
- Investigators returned to Nancy Guthrie’s home and surrounding neighborhood on Friday to continue the search one week after her disappearance.
- Doorbell camera footage is currently unavailable because Guthrie did not have an active subscription; the device was disconnected early Sunday and only software movement data remain.
- FBI Phoenix chief Heith Janke publicly described ransom‑note details, including a Thursday evening money deadline with a second Monday deadline and references to a floodlight at the home and an Apple Watch.
- Pima County Sheriff Chris Nanos told AP that technology companies have informed investigators about limits on what doorbell‑camera data they can still retrieve.
12:40 AM
Sheriff says investigators are conducting follow-up at Nancy Guthrie's home
New information:
- CBS reiterates that investigators are conducting 'follow-up' work at Nancy Guthrie’s home and are examining a newly received message tied to the suspected abduction.
- The segment adds expert commentary from former NYPD detective Kirk Burkhalter on investigative steps and how law enforcement will vet such messages, but no concrete new factual developments beyond the already-reported 'new message'.
February 06, 2026
11:11 PM
Authorities say "they're aware of a new message" in Nancy Guthrie's disappearance
New information:
- Beyond the earlier confirmation that the blood at the scene is Nancy’s, authorities now say they are reviewing a new message connected to her disappearance.
- Investigators publicly underscore again that there is still no named suspect or person of interest despite the new communication.
February 05, 2026
11:50 PM
Search continues for Nancy Guthrie as authorities seek leads to find suspects
New information:
- Adds that, after the confirmation that blood at the scene was Nancy Guthrie’s, investigators are publicly characterizing the situation as a kidnapping and say they believe she is still alive.
- Clarifies that as of Thursday there are still no suspects, despite multi‑day intensive investigation and forensic processing of the home.
- Reiterates the FBI’s $50,000 reward, framing it as a key tool in seeking leads from the public.