Digital forensics can be a tool to help ‘paint a picture of the truth’ in the Guthrie case

As the investigation into Nancy Guthrie’s disappearance continues with no suspect publicly identified and challenges with DNA evidence, experts may be turning to digital forensics.

Authorities have said little about digital evidence in the case, but one leading expert has no doubt that whoever caused the 84-year-old’s disappearance left a digital trail.

“People forget how spread out their data is across devices. So the same thing that makes investigation difficult is also making it difficult for criminals to clean up,” said Heather Barnhart, digital forensics expert for the SANS Institute and Cellebrite.

Barnhart helped investigate the University of Idaho murders, in which Bryan Kohberger was sentenced to four life terms. Barnhart is not involved in Guthrie’s investigation.

“Your phone is silent evidence of your life. It knows everything you do,” Barnhart said. “So building those patterns and looking for any anomalies of someone trying to hide their digital location is important here.”

It has been nearly five weeks since Guthrie, the mother of “TODAY” co-star Savannah Guthrie, was reported missing on February 1st.

Since then, digital forensics has helped uncover images of a masked man captured on Nancy Guthrie’s doorbell camera in the hours before she was reported missing — but authorities have not publicly identified a suspect or person of interest.

Concerns about Guthrie have only just ended, as his family on Tuesday announced a $1 million reward for his recovery.

Investigators seem to have faced some obstacles in the case: DNA evidence from gloves found two miles from Guthrie’s home did not match CODIS, the FBI’s DNA database of the convicted.

Authorities are also testing DNA collected from Guthrie’s home. Pima County Administrator Chris Nanos said he hoped they would be able to use investigative genealogy — a forensic tool that combines advanced DNA analysis with traditional genealogical research — but the lab that obtained the DNA reported “challenges” with the sample.

Nanos said his team is determined to chase leads until they find Guthrie.

“We will not give up, we will find Nancy, we will find out who did this,” he said earlier this month.

Chris Burbank, former Salt Lake City police chief, said physical evidence is not the only thing that can open a case.

“Let’s really start putting together all the other information that exists in the world,” he said.

He suggested that investigators could use artificial intelligence to trace leads on social media because “most of the time, the people involved in this leave some kind of social media.”

Barnhart, a digital forensics expert, said that eventually, when the digital evidence in Guthrie’s case is found, it will “repaint the true picture.” Digital evidence can come from naming a suspect or person of interest, or if a barcode reader or other type of technology finds a clue, he said.

Digital forensics involves the analysis of data from digital devices and remote corners of the Internet and cloud services.

He said that when he reviewed Kohberger’s background in the 2022 University of Idaho murder case, at first “the lack of evidence upset everyone.”

“My husband and I worked on this case, we focused a lot on it [laptop and phone] logs that tell the truth about why there is no evidence. And that was Bryan Kohberger’s booking for being awake at those hours, hand-downing a device that had 100% battery. So he set a good time for us to sharpen ourselves with that investigation,” he explained.

Hours before the four Idaho students were killed, Kohberger left his home in Washington and disabled or turned off his phone, and it did not return to the Internet until after their deaths, according to a probable cause affidavit.

Barnhart said phones provide insight into a person’s normal patterns and habits, but they may not follow those same patterns before a crime.

“Typically, you don’t do the same thing every day the same way you would on the day you commit the crime,” he said.

In digital forensics, analysts combine everything from cell tower data and Wi-Fi logs to mobile data and the cloud, where information is stored digitally.

“Your phone is a really smart device,” she said. “The places you go, the times you turn your phone on airplane mode, when you put your device on Do Not Disturb, when you turn off the cell phone, turn it back on. All of this is logged, and those logs are some of the most important information we get in digital forensics,” he said.

He said even in difficult situations, there is always a digital channel.

“There really is no such thing as a perfect crime,” he said.