Digital forensics could be the tool that helps ‘paint a picture of truth’ in the Guthrie case

As the investigation into Nancy Guthrie’s disappearance continues with no suspect publicly identified and challenges with DNA evidence, experts may turn to digital forensics.

Authorities have said little about digital evidence in the case, but one leading expert has no doubt that whoever is responsible for the 84-year-old’s disappearance left a digital trail.

“People forget how much their data spreads across devices. So the same thing that makes investigations hard make it hard for criminals to clean up,” said Heather Barnhart, a digital forensics expert with the SANS Institute and Cellebrite.

Barnhart helped investigate the University of Idaho murders, for which Bryan Kohberger was sentenced to four life sentences. Barnhart is not involved in the Guthrie investigation.

“Your phone is the silent witness to your life. It knows everything you do,” Barnhart said. “So forming those patterns and then looking for any anomaly of someone trying to hide their digital footprint is key here.”

It’s been nearly five weeks since Guthrie, the mother of “TODAY” co-anchor Savannah Guthrie, was reported missing on Feb. 1.

Since then, digital forensics has helped unearth images of a masked man captured on Nancy Guthrie’s doorbell camera in the hours before she was reported missing — but authorities have not publicly identified a suspect or person of interest.

Concern for Guthrie has only mounted, as her family on Tuesday announced a $1 million reward for her recovery.

Investigators appear to have faced some obstacles in the case: DNA evidence from gloves found two miles from Guthrie’s home turned up no hits in CODIS, the FBI’s convicted offender DNA database.

Authorities are also examining DNA collected from Guthrie’s home. Pima County Sheriff Chris Nanos has said he is hopeful they will be able to use investigative genetic genealogy — a forensic tool that combines advanced DNA analysis with traditional genealogical research — but the lab that received the DNA has reported “challenges” with the sample.

Nanos has said that his team is committed to chasing leads until they find Guthrie.

“We’re not going to give up. We’re going to find Nancy, and we’re going to find out who did this,” he said earlier this month.

Chris Burbank, a former police chief in Salt Lake City, said that physical evidence is far from the only thing that can crack a case.

“Let’s really start combing every other bit of information that exists out there in the world,” he said.

He suggested that investigators could use artificial intelligence to track social media leads because “most of the time, people involved in this leave some sort of social media trail.”

Barnhart, the digital forensics expert, said that eventually, when digital evidence in the Guthrie case becomes available, “it will also paint a picture of truth.” Digital evidence could arise with the naming of a suspect or a person of interest, or if a license plate reader or other form of technology picks up clues, she said.

Digital forensics involves the analysis of data from digital devices and the far-reaching corners of the internet and cloud services.

She said when she worked on analyzing the digital footprint of Kohberger in the 2022 University of Idaho murders case, initially “the lack of evidence freaked everyone out.”

“My husband and I worked on that case, we really focused on the [laptop and phone] logs that tell the truth on why there wasn’t evidence. And that became the bookend of Bryan Kohberger being awake at those hours, manually powering down a device that was at 100% battery. So he created a perfect timeline for us to hone in on that investigation,” she explained.

A couple of hours before the four Idaho students were killed, Kohberger left his home in Washington and disabled or turned off his phone, and it did not go back online until after their deaths, according to a probable cause affidavit.

Barnhart said phones give insight into a person’s regular patterns and habits, but they may not follow those same patterns before a crime.

“Typically, you don’t do the same thing every single day in the same way you’re going to act the day you commit a crime,” she said.

In digital forensics, analysts comb through everything from cell tower data and Wi-Fi logs to travel data and the cloud, where information is stored digitally.

“Your phone is a really smart device,” she said. “Locations that you’ve traveled to, times you turn your phone into airplane mode, if you put your device in Do Not Disturb, when you turn off cellular, you turn it back on. All of this is logged, and those logs are some of the most valuable pieces of information we get in digital forensics,” she said.

She said even in tough cases, there’s always a digital trail.

“There really isn’t a perfect crime,” she said.