Listen to this article with a free account
As the investigation into Nancy Guthrie’s disappearance continues with no suspects publicly identified and DNA evidence disputed, experts may turn to digital forensics.
Authorities have said little about the digital evidence in the case, but a leading expert is convinced whoever was responsible for the 84-year-old’s disappearance left a digital trail.
“People forget how distributed their data is across all devices, so the same thing that makes investigations difficult makes it difficult to clean up on criminals,” said Heather Barnhart, a digital forensics expert at the SANS Institute and Cellebrite.
Barnhart helped investigate Murders at the University of Idahofor which Bryan Kohberger was sentenced to four life sentences. Barnhart is not involved in the Guthrie investigation.
“Your phone is the silent witness to your life. It knows everything you do,” Barnhart said. “So it’s critical to train these models and then look for any anomalies in someone trying to hide their digital footprint.”
It’s been nearly five weeks since Guthrie, the mother of “TODAY” co-anchor Savannah Guthrie, was reported missing on February 1.
Since then, digital forensics has made it possible to discover Footage of a masked man captured by Nancy Guthrie’s doorbell camera in the hours before she disappeared — but authorities have not publicly identified a suspect or person of interest.
Concern for Guthrie has only grown, as his family announced Tuesday a Million dollar reward for his recovery.
Investigators appear to have faced some obstacles in the case: DNA evidence from gloves found two miles from Guthrie’s home was found. no results in CODISthe FBI’s convict DNA database.
Authorities are also examining DNA collected from Guthrie’s home. Pima County Sheriff Chris Nanos said he hopes they can use investigative genetic genealogy – a forensic tool that combines advanced DNA analysis with traditional genealogical research – but the lab that received the DNA reported “challenges” with the sample.
Nanos said his team is committed to pursuing leads until they find Guthrie.
“We’re not going to give up. We’re going to find Nancy and we’re going to find out who did this,” he said earlier this month.
Chris Burbank, a former Salt Lake City police chief, said the physical evidence was far from being the only thing it can solve a case.
“Let’s really start combing through all the other information that’s out there in the world,” he said.
He suggested that investigators could use artificial intelligence to follow leads on social media, because “most of the time the people involved in this case leave some sort of trail on social media.”
Barnhart, the digital forensics expert, said that eventually, when the digital evidence in the Guthrie case becomes available, “it will also paint a picture of the truth.” Digital evidence could appear with the name of a suspect or person of interest, or if a license plate reader or other form of technology detects clues, she said.
Digital forensics involves the analysis of data from digital devices and the farthest corners of the internet and cloud services.
She said that while working on the analysis of Kohberger’s digital footprint in the 2022 University of Idaho murders caseat first, “the lack of evidence freaked everyone out.”
“My husband and I worked on this case, we really focused on the [laptop and phone] newspapers that tell the truth about why there was no evidence. And that became the time when Bryan Kohberger was awake at those hours, manually turning off a device that was at 100% battery. So he created a perfect timeline for us to refine this investigation,” she explained.
Hours before the four Idaho students were killed, Kohberger left his home in Washington and deactivated or turned off your phoneand it was not put back online until after their deaths, according to a probable cause affidavit.
Barnhart said phones provide insight into a person’s usual patterns and habits, but they may not follow those same patterns before a crime.
“Usually you don’t do the same thing every day, or the same way you will act on the day you commit a crime,” she said.
In digital forensics, analysts examine everything from cell tower data and Wi-Fi logs to travel data and the cloud, where information is stored digitally.
“Your phone is a really smart device,” she said. “The places you’ve traveled, the times you put your phone on airplane mode, if you put your device on Do Not Disturb mode, when you turn the cell off, you turn it back on. All of that is recorded, and those logs are some of the most valuable information we get in digital forensics,” she said.
She added that even in difficult cases, there was always a digital trail.
“There really isn’t a perfect crime,” she said.