As the investigation into Nancy Guthrie’s disappearance continues without a publicly identified suspect and challenges with DNA evidence, experts may turn to digital forensics.
Officials have said little about the digital evidence in the case, but a leading expert has no doubt the 84-year-old’s disappearance left a digital trail.
“People forget how much data is spread across their devices. So the same thing that makes it hard to investigate is also hard for criminals to clean up,” said Heather Barnhart, a digital forensics expert at the SANS Institute and Celebrate.
Barnhart helped investigate the University of Idaho murders, for which Brian Kohberger was sentenced to four life terms. Barnhart Guthrie was not involved in the investigation.
“Your phone is a silent witness to your life. It knows everything you do,” Barnhart said. “So the key here is to map out those patterns and then look for any anomalies where someone is trying to hide their digital footprint.”
Much coverage of Nancy Guthrie’s disappearance
It’s been nearly five weeks since Guthrie, the mother of “Today” co-anchor Savannah Guthrie, was reported missing on Feb. 1.
Since then, digital forensics has helped locate images of the masked man captured on Nancy Guthrie’s doorbell camera before she was reported missing — but authorities have not publicly identified a suspect or person of interest.
Guthrie’s concern grew as his family announced a $1 million reward Tuesday for his recovery.
Investigators seem to have run into some obstacles in the case: DNA evidence from gloves found two miles from Guthrie’s home found no hits in CODS, the FBI’s criminal DNA database.
Authorities are also examining DNA collected from Guthrie’s home. Pima County Sheriff Chris Nanos said he was hopeful he would be able to use investigative genetic genealogy — a forensic tool that combines advanced DNA analysis with traditional genealogy research — but reported “challenges” with the lab sample the DNA received.
Nanos said his team is committed to leading until Guthrie is found.
“We’re not going to give up. We’re going to find Nancy and we’re going to find out who did this,” he said earlier this month.
Former Salt Lake City Police Chief Chris Burbank said physical evidence is far from the only thing that can crack a case.
“Let’s start really assembling every other bit of information that’s out there in the world,” he said.
He suggested that investigators could use artificial intelligence to track down social media leads because “most of the time, the people involved leave some sort of social media trail.”
Barnhart, a digital forensics expert, said that when digital evidence finally becomes available in the Guthrie case, “it will also paint a picture of the truth.” Digital evidence may arise with the name of a suspect or person of interest, or if a license plate reader or other similar technology picks up clues, he said.
Digital forensics involves data analysis from digital devices and far-reaching corners of the Internet and cloud services.
When he worked to analyze Kohberger’s digital footprint in the 2022 University of Idaho murder case, he said, initially “the lack of evidence shocked everyone.”
“My husband and I worked on that case, we really focused on the (laptop and phone) logs that would tell the truth as to why there was no evidence. And Brian Kohberger became the book on being awake at the time, manually powering down a device that was on 100% battery. So he created a timeline that was perfect for developing that investigation,” she explained.
A couple of hours before the four Idaho students were killed, Kohberger left his home in Washington and disabled or turned off his phone, and it hasn’t come back online since his death, according to a probable cause affidavit.
Barnhart said the phones give insight into a person’s regular patterns and habits, but they may not follow the same patterns as before the crime.
“Typically, you don’t do the same thing every day, the same way you’re going to act on the day you commit a crime,” he said.
In digital forensics, analysts comb through everything from cell tower data and Wi-Fi logs to travel data and the cloud, where information is stored digitally.
“Your phone is a really smart device,” he said. “The places you travel, when you turn your phone to airplane mode, when you don’t disturb your device, when you turn off cellular, you turn it back on. All of that is logged, and those logs are some of the most valuable information we get in digital forensics,” he said.
He said there is always a digital trail even in difficult situations.
“There really is no perfect crime,” he said.
