What the Guthrie case reveals about your ‘deleted’ doorbell footage

FBI Director Kash Patel said yesterday that investigators recovered footage from Savannah Guthrie’s mother’s doorbell camera using… “Residual data residing in back-end systems.” This claim prompts many home security camera users to ask an uncomfortable question: Did your data really disappear when you hit delete?

When Nancy Guthrie disappeared, officials said she had a doorbell camera, but it was forcibly removed, and she did not have a subscription. This means no videos stored in the cloud. Ten days later, the FBI released him Camera shotswhich is revealed to be A Nest doorbellThe masked suspect is clearly visible.

This is a major turn in the case and highlights the value of security cameras in solving crimes, even if their deterrent effect remains largely unproven. But it raises privacy concerns about how to recover this supposedly “lost” footage.

How did Google recover deleted snapshots that the user account couldn’t access? Does this mean that deleted footage can be accessed by law enforcement? The answer to the second question, according to a forensic expert I spoke with, is technically yes. Deleted footage stored in the cloud can be recovered, but in this case, it may have been very difficult, and the resources to do so were likely only available due to the notoriety of the case.

I’ve also reached out to Google, but they haven’t provided any further information Of confirmation It “assists law enforcement authorities in their investigations.”

To understand what likely happened, it’s helpful to know how Google Nest cameras work, because they work differently than most cameras on the market. Most only stream live footage unless you pay for a subscription to the company’s cloud service or use local storage, such as a microSD card or a home hub.

In contrast, Nest cameras can send clips to Google’s servers even without requiring a connection Paid subscription. Google offers a small amount of free cloud storage, with older models storing clips of up to five minutes for three hours; the Latest models Store 10-second clips for six hours. This means that some footage is uploaded and stored, at least temporarily, whether you pay or not.

Unlike most competitors, Google doesn’t offer true local storage that you can access yourself. The latest Nest cameras are limited Store backups on the devicebut can only be accessed through Google Cloud.

All of this means that the suspect’s footage went to Google’s servers, even though Nancy Guthrie did not pay for the subscription. Assuming Guthrie didn’t have the latest Nest Doorbell, which launched last October, her doorbell would have been able to record five-minute clips, and she would have been able to access them via the Nest app or Google Home for up to three hours after recording.

The Pima County Sheriff’s Department said the doorbell was disabled at 1:47 a.m. on February 1, and she was not reported missing until the next morning, more than three hours later. By then, these recordings are no longer available to anyone with access to the account. (It’s possible that members of the Guthrie family have access to the app; I know I have access to my elderly parents’ video doorbell app.)

But since it was in the cloud before, there was a chance to recover it. According to Nick Barreiro, senior forensic analyst at… Forensic principleDeleting snapshots from the cloud does not necessarily mean they disappear immediately. “When you delete something from the server, it doesn’t get overwritten immediately — the file system is just told to discard that data, and that space is now available for use. But if no new data is overwritten, it’s still there, even though you can’t see it.”

While it would be fairly easy to retrieve this data from a local server or hard drive, Barreiro said the process of retrieving it from Google’s servers would likely be more complicated.

While Barreiro has no direct knowledge of Google’s operations, he spent a decade in law enforcement focusing on recorded evidence before moving to the private sector five years ago. “These video files are not necessarily all stored on one server; they are likely to be stored in parts in servers all over the world. It may become very complex with Google’s architecture,” he said.

While the basic data recovery process remains the same, finding these files is like searching for a needle in a haystack. “Because they’ve been deleted, the file system doesn’t recognize them anymore,” he says. “So you search for them manually.”

There may be other reasons why the snapshots took more than a week to be released. Barreiro says it’s possible that Google will be able to access it immediately, but it won’t release the footage without following the proper legal procedures. “Google is known to be uncooperative with law enforcement; they will comply with search warrants, but in the least possible way and they will fight them,” he says. “It’s likely that the delay was just going through those legal processes, properly worded court orders, and Google’s lawyers opposing them.”

However, he says this seems unlikely, given the high-profile nature of the case. In addition, Reports indicate It took Google engineers “several days” to recover the footage.

But it is an important point for those who are concerned about the possibility of accessing their data after deleting it. Although this was technically possible in this case, it is unlikely to happen regularly. Barreiro believes this is “not something Google would ever do in a typical situation.”

Ring, which also stores its video in the cloud, told me that the concept of “residual data” is unfamiliar to them. “We ran into this issue when people deleted footage and asked if we could help restore it,” Ring spokeswoman Emma Daniels said. “But he’s gone.”

While this case shows that recovery is technically possible, it also shows that it is rare, resource-intensive, and reserved for exceptional circumstances. But if the idea makes you uncomfortable, you can reduce your risk with Local storage that you control And/or a cloud service that offers end-to-end encryption, meaning that not even the provider can access your footage.