Mistake by man at Nancy Guthrie’s door may have led to key video recovery, Houston IT expert says

In a significant breakthrough in the Nancy Guthrie disappearance case, FBI investigators successfully recovered crucial doorbell camera footage that had initially been thought lost, revealing that digital evidence can sometimes persist even after devices are disconnected or damaged.

The surveillance video, showing an armed, masked individual at the 84-year-old’s front door, emerged on the 10th day following the disappearance of the mother of TODAY show co-anchor Savannah Guthrie.

READ MORE: FBI releases surveillance photos of potential subject in Nancy Guthrie case

In a post on X, FBI Director Kash Patel announced the footage was recovered “from residual data located in backend systems,” highlighting the sophisticated technical capabilities of modern digital forensics.

“Even when you delete things from the internet, it’s still there,” said Dennis Franks, a retired FBI Houston agent.

Franks, who worked kidnapping cases as an agent but was not familiar with the specific technical maneuvers used to recover the video, said the recovery of such data requires specialized tools, sometimes multiple attempts, and can be unpredictable.

To obtain such data, Franks explained, investigators would need either consent or a court order. He said he does not have concerns about privacy risks for other camera users after the government accessed the camera.

“I just see how difficult this was,” Franks said, “and there just wouldn’t be the capacity, the resources, or even the interest to monitor everybody’s cameras and networks. And it would be illegal.”

The case has drawn national attention, particularly after the FBI released images showing the masked subject tampering with Guthrie’s Nest camera system in the early morning hours of Feb. 1.

According to Pima County Sheriff Chris Nanos, the doorbell camera was disconnected at approximately 1:47 a.m. that day.

IT expert Nigel Neilsen of Nickel Idealtek Inc. told KPRC 2 News that the perpetrator’s decision to disable the camera may have inadvertently preserved the crucial evidence, since Guthrie did not have a subscription that saved video events.

“They claim in the disclosure from the FBI that they found it in residual data, which to me means that it was found in a area of a hard drive that was probably marked for deletion. And the data just had not yet been overwritten,” Neilsen said.

According to Neilsen, Nest cameras usually re-write video after three to six hours, depending on the model. The disconnection, Neilsen said, stopped the camera from recording anything additional.

“If the camera hadn’t been disabled, the activities of the family the following day and law enforcement thereafter would have overwritten that video,” Neilsen said.

Asked if the perp may have made a mistake, Neilsen said: “He didn’t destroy the video and, in this instance, he made it possible for the video to be recovered.”

FBI officials have not revealed the specific methods investigators used to uncover the video, though Patel noted on X that it involved a partnership with partners.

Major technology companies, including Google (which owns Nest) and Ring, maintain protocols for emergency situations, Neilsen noted. These companies may disclose data to law enforcement if there is potential to prevent death or serious injury, particularly when obtaining a warrant would take too long.

The case took another turn Monday night when authorities detained a person of interest in Rio Rico, Arizona, about 60 miles south of Tucson. The individual, who identified himself to media outlets as Carlos Palazuelos, was later released after questioning.

The FBI is offering a $50,000 reward for information leading to Nancy Guthrie’s whereabouts.

The investigation remains active, with law enforcement continuing to analyze additional surveillance footage from the area.