How Police Recovered Nancy Guthrie’s Doorbell Footage Despite It Being ‘Deleted’

FBI Director Kash Patel revealed that investigators managed to recover footage from a doorbell camera belonging to Savannah Guthrie’s mother by utilizing “residual data located in backend systems.” This revelation has sparked concerns among home security camera users about whether deleted data is truly gone for good.

When Nancy Guthrie went missing, authorities noted that her doorbell camera had been forcibly removed and that she lacked a subscription, meaning no videos were stored in the cloud. However, ten days later, the FBI released footage from the camera, identified as a Nest Doorbell, which clearly showed a masked suspect.

This significant breakthrough underscores the importance of security cameras in crime-solving, even if their effectiveness as a deterrent is still debated. Yet, it raises pressing privacy questions about how this supposedly “lost” footage was retrieved.

How did Google manage to access footage that was deleted and not available to the user’s account? According to a forensic expert, the answer is technically yes—deleted footage stored in the cloud can be recovered. However, in this instance, it was likely a challenging process, with the resources for recovery being allocated due to the case’s high profile.

I reached out to Google, but they only confirmed that they are “assisting law enforcement with their investigations” without providing further details.

To grasp what likely occurred, it’s essential to understand how Google’s Nest cameras function, as they differ from many other cameras on the market. Most cameras only stream live footage unless users pay for a cloud service subscription or utilize local storage options like a microSD card.

Nest cameras, however, can upload clips to Google’s servers even without a paid subscription. Google provides a limited amount of free cloud storage—older models can store clips up to five minutes long for three hours, while newer models can store 10-second clips for six hours. This means some footage is uploaded and temporarily stored, regardless of subscription status.

Unlike many competitors, Google doesn’t offer true local storage accessible by users. Newer Nest cameras do have limited on-device backup storage, but it’s only retrievable through Google’s cloud.

This setup means that footage of the suspect was sent to Google’s servers, even though Nancy Guthrie didn’t have a subscription. Assuming she didn’t have the latest Nest Doorbell, which was released last October, her doorbell would have been capable of recording five-minute clips, accessible via the Nest or Google Home app for up to three hours after recording.

The Pima County Sheriff’s Department reported that the doorbell was disabled at 1:47 AM on February 1st, and she was not reported missing until the following morning, over three hours later. By that time, those recordings were no longer accessible to anyone with account access. (It’s possible that family members had access to the app; I know I have access to my elderly parents’ video doorbell app.)

However, since the footage had once been in the cloud, there was a chance it could be retrieved. Nick Barreiro, chief forensic analyst with Principle Forensics, explained that deleting footage from the cloud doesn’t mean it’s immediately erased. “When you delete something from a server, it doesn’t get overwritten immediately—the file system is just told to ignore this data, and this space is now available to be used. But if no new data is written over it, it’s still going to be there, even though you can’t see it.”

While retrieving this data from a local server or hard drive would be relatively straightforward, Barreiro noted that accessing it from Google’s servers is likely much more complex.

Although Barreiro lacks direct knowledge of Google’s processes, he has a decade of law enforcement experience focused on recorded evidence before transitioning to the private sector. “These video files aren’t necessarily all stored on a single server; they are probably stored in fragments across servers worldwide. It probably gets very complicated with Google’s architecture,” he said.

While the basic data recovery process remains consistent, locating these files is akin to searching for a needle in a haystack. “Because they have been deleted, they aren’t identified by the file system anymore,” he explained. “So you’re manually looking for them.”

There may be additional reasons for the week-long delay in releasing the footage. Barreiro suggested that Google might have accessed it immediately but withheld it pending the proper legal procedures. “Google is notoriously uncooperative with law enforcement; they will comply with search warrants, but in the least helpful way possible and they will fight it,” he stated. “It’s possible the delay was just getting through that legal process, properly worded court orders, and Google’s lawyers fighting it.”

However, he believes this scenario seems unlikely given the case’s high profile. Reports indicate it took Google’s engineers “several days” to recover the footage.

This situation raises important considerations for those worried about their data being accessible after deletion. While it was technically possible in this case, it’s not something that happens regularly. Barreiro believes this is “absolutely not something Google would do in a typical case.”

Another company that stores video in the cloud, Ring, stated that they are unfamiliar with the concept of “residual data.” “We have run into this issue when folks have deleted footage and asked us if we can help get it back,” said a spokesperson. “But it’s gone.”

While this case illustrates that recovery is technically feasible, it also highlights that it is rare, resource-intensive, and reserved for extraordinary circumstances. If this notion makes you uneasy, consider reducing your risk by utilizing local storage that you control or a cloud service that offers end-to-end encryption, ensuring that not even the provider can access your footage.