How Google played a key role in recovering the video from Nancy Guthrie’s cameras

A significant development in the investigation surrounding Nancy Guthrie's disappearance has emerged, largely thanks to the technical capabilities of Google. A source close to the inquiry informed CNN that the recovery of crucial video footage was a pivotal moment for law enforcement. Nancy Guthrie, the mother of 'Today' host Savannah Guthrie, vanished over a week ago in Arizona. However, authorities unveiled footage showing a masked and armed individual outside her residence on the day she went missing, after initially stating that the video could not be retrieved. Engineers at Google, which owns the Nest product line, managed to recover the data following several days of intensive effort. The complexity of the task left investigators uncertain of its eventual success, as revealed by the source. An official from the FBI confirmed on social media that the bureau was able to release the images within hours of acquiring them. Initially, Pima County Sheriff Chris Nanos indicated there was "no video available" due to Guthrie's lack of a subscription to Google’s video recording service, which typically allows access to recorded footage through Google’s cloud. Nevertheless, Nest devices automatically retain approximately three hours of event-triggered video for free before it is erased, with this data being stored on Google’s servers. Even if the data had been marked for deletion, experts suggest it could still be recoverable. Nick Barreiro, a forensic analyst and founder of Principle Forensics, explained that files designated for deletion can remain intact until they are overwritten by new data. "A delete command simply tells the file system to disregard that data and utilize the space for new information. Until that space is repurposed, the previous data can still be retrieved," Barreiro noted, emphasizing that he has successfully found fragments of video files months or even years after they were deleted. FBI Director Kash Patel reported on Tuesday that authorities, collaborating closely with private sector partners, managed to recover some video from residual data within backend systems related to the Guthrie case. The investigation had included a search warrant sent to Google concerning the Nest cameras at Guthrie's home, a common procedure in criminal inquiries. Adam Malone, a leading cyber crisis expert at the cybersecurity firm Kroll and a former FBI agent focused on cyber issues, explained that video from cloud-based systems traverses numerous layers of components to function correctly. This complexity increases the likelihood of residual data being retained. "Data passes through various layers, each with its own processing functions, which can create opportunities for recovery," Malone stated, underscoring the intricate architecture of application and data management that enhances the chances of retrieving lost footage.