Digital forensics could be the tool that helps ‘paint a picture of truth’ in the Guthrie case
Digital forensics offers critical insight in Nancy Guthrie’s mysterious disappearance
Over five weeks have passed since Nancy Guthrie, mother of “TODAY” co-anchor Savannah Guthrie, was last seen. Despite no public suspect being named, investigators are increasingly relying on digital forensics to uncover clues. While authorities have not yet disclosed significant findings, experts believe the case may hold a digital trail that could reveal the truth.
Heather Barnhart, a digital forensics specialist with the SANS Institute and Cellebrite, emphasized the importance of digital evidence. “Individuals often overlook the vast extent of their data across multiple devices,” she said. “The same factors that complicate investigations also make it difficult for criminals to erase their digital footprint.” Barnhart, who worked on the 2022 University of Idaho murders, noted that her experience highlights how technology can shape criminal cases.
“Your phone acts as a silent witness to your daily activities, capturing every action you take,” Barnhart added. “Identifying deviations in a person’s routine is essential when searching for hidden patterns.”
Authorities have encountered challenges with DNA evidence, including a sample from gloves two miles from Guthrie’s home that produced no matches in CODIS, the FBI’s database. Meanwhile, the family has offered a $1 million reward for her safe return. Pima County Sheriff Chris Nanos expressed optimism about using investigative genetic genealogy, a method that merges DNA analysis with genealogical research, but acknowledged technical hurdles with the current sample.
Chris Burbank, a former Salt Lake City police chief, argued that physical evidence is not the only path to solving the case. “Investigators should explore every possible data source,” he said. “Criminals often leave a digital footprint through social media, which can be traced using artificial intelligence tools.”
Barnhart explained how digital forensics works: analyzing data from phones, cloud services, and internet logs to reconstruct timelines. In the Idaho case, she described how a lack of physical evidence initially confused the team. “We focused on phone and laptop logs that revealed Bryan Kohberger’s actions,” she said. “These logs showed he manually powered down his device before the murders, creating a clear timeline that guided the investigation.”
With digital evidence still pending, Barnhart remains confident. “Eventually, this data will provide a clearer narrative,” she said. “Whether through a named suspect or unexpected technological clues, it will help form a definitive picture of what happened.”