How Google played a key role in recovering the video from Nancy Guthrie’s cameras

By Hadas Gold, Brian Stelter, CNN

(CNN) — A major breakthrough in the Nancy Guthrie case largely came down to Google’s technical expertise, a person familiar with the investigation told CNN.

The mother of “Today” host Savannah Guthrie disappeared over a week ago in Arizona. But on Tuesday, authorities revealed footage of a masked and armed person outside her door on the day she went missing after initially saying the video was not able to be recovered. Engineers at Google, which owns Nest, were able to recover data after several days.

The task was so technically complex that investigators didn’t know if it would be successful, the source said. An FBI official said on X that the bureau released the images within hours of obtaining them.

CNN reached out to Nest and Google for comment.

Pima County Sheriff Chris Nanos initially said there was “no video available” because Guthrie “had no subscription” to Google’s video recording service, which keeps videos from Nest cameras accessible in Google’s cloud.

But Nest still saves around three hours of “event-based” video history for free before being deleted. That data lives in Google’s cloud and servers. Even if the data had been deleted from Google’s systems, it could still exist somewhere and be recoverable because even files slated for deletion can exist until they are overwritten by new data, said Nick Barreiro, an audio-video forensic analyst and the founder of Principle Forensics.

“A delete function is just telling the file system to ignore that data and feel free to use that space on the hard drive for new data …. so until it’s actually used again, that old data is still recoverable,” Barreiro said. “I’ve had cases where I could go back months or even years and find little fragments of video files that were still on the hard drive.”

FBI Director Kash Patel wrote on social media Tuesday that authorities, “working closely with our private sector partners,” recovered some video “from residual data located in backend systems” in the Guthrie case.

Investigators had sent a search warrant to Google for the Nest cameras at the Guthrie residence last week, the source added. Such a move is common in a criminal investigation.

Adam Malone, the top cyber crisis expert at cybersecurity advisory firm Kroll and a former cyber-focused FBI special agent, told CNN that video recorded by cloud-based systems goes through “layers and layers” of components to make the application work.

For example, “there might be one that just processes the data into a new compressed format,” Malone said. “There might be one that renders it a certain visual format.”

The footage and its underlying data could go through hundreds of thousands of servers and systems all over the world — increasing the chance of residual data being left behind.

“All those layers have code, and as data moves around to be processed and made available to the customer, it will move through different layers of sub applications, sub servers, sub storage components,” Malone said, speaking generally about application architecture and data handling.

Each of those components would present an opportunity for data recovery, Malone said.

“They would have all looked at their development pipelines to say, ‘Hey, do we process any data? Do we have any historical data that’s still sitting here waiting to be purged?” Malone said. “It could be that this one, just for some reason, was in a queue that hadn’t been processed and it just still existed.”

The-CNN-Wire
™ & © 2026 Cable News Network, Inc., a Warner Bros. Discovery Company. All rights reserved.