What the Guthrie case reveals about your ‘deleted’ doorbell footage

FBI Director Kash Patel said yesterday that investigators recovered footage from Savannah Guthrie’s mother’s doorbell camera using “residual data located in backend systems.” This claim has many home security camera users asking an uncomfortable question: Is your data really gone when you hit delete?

When Nancy Guthrie went missing, officials said she had a doorbell camera, but that it had been forcibly removed, and she did not have a subscription. This meant there were no videos stored in the cloud. Ten days later, the FBI released footage from the camera, which was revealed to be a Google Nest Doorbell, clearly showing the masked suspect.

This is a huge break in the case and highlights the value of security cameras in solving crimes, even if their deterrent effect remains largely unproven. But it raises privacy concerns around how this supposedly “lost” footage was recovered.

How did Google retrieve footage that was deleted and that the user’s account didn’t have access to? Does this mean your deleted footage could be accessed by law enforcement? The answer to the second question, according to a forensic expert I spoke to, is technically yes. Deleted footage stored in the cloud can be recovered, but in this case, it was probably very difficult, and the resources to do so were likely made available only because of the case’s high profile.

I also reached out to Google, but it did not provide any additional information other than confirming that it is “assisting law enforcement with their investigations.”

To understand what likely happened, it helps to know how Google’s Nest cameras work, because they operate differently from most cameras on the market. Most video doorbells only stream live footage, unless you either pay for a subscription to the company’s cloud service to store recorded video, or use local storage, such as a microSD card or a home hub.

Nest cameras, by contrast, can send clips to Google’s servers even without a paid subscription. Google offers a small amount of free cloud storage — older models store clips up to five minutes long for three hours; the latest models store 10-second clips for six hours. That means some footage is uploaded and stored, at least temporarily, whether you pay or not.

Unlike most competitors, Google doesn’t offer true local storage that you can access yourself. Newer Nest cameras do have limited on-device backup storage, but it’s only accessible through Google’s cloud.

All of this means the footage of the suspect went to Google’s servers, even though Nancy Guthrie did not pay for a subscription. If we assume Guthrie did not have the latest Nest Doorbell, which launched last October, then her doorbell would have been capable of recording five-minute clips, and she would have had access to them via the Nest or Google Home app for up to three hours after recording.

The Pima County Sheriff’s Department said the doorbell was disabled at 1:47AM on February 1st, and she was not reported missing until the next morning, more than three hours later. By that time, those recordings were no longer accessible to anyone with access to the account. (It’s possible members of the Guthrie family had access to the app; I know I have access to my elderly parents’ video doorbell app.)

But because it had once been in the cloud, there was a chance it could be retrieved. According to Nick Barreiro, chief forensic analyst with Principle Forensics, deleting footage from the cloud doesn’t necessarily mean it’s immediately gone. “When you delete something from a server, it doesn’t get overwritten immediately — the file system is just told to ignore this data, and this space is now available to be used. But if no new data is written over it, it’s still going to be there, even though you can’t see it.”

While it would be fairly straightforward to retrieve this data from a local server or hard drive, Barreiro said the process to retrieve it from Google’s servers was likely much more complicated.

While Barreiro has no direct knowledge of Google’s processes, he spent a decade in law enforcement focused on recorded evidence before moving to the private sector five years ago. “These video files aren’t necessarily all stored on a single server; they are probably stored in fragments in servers all over the world. It probably gets very complicated with Google’s architecture,” he said.

While the basic data recovery process remains the same, finding these files is like searching for a proverbial needle in a haystack. “Because they have been deleted, they aren’t identified by the file system anymore,” he says. “So you’re manually looking for them.”

There may be other reasons it took over a week for the footage to be released. Barreiro says it could be that Google was able to access it immediately, but wouldn’t release the footage without the proper legal process. “Google is notoriously uncooperative with law enforcement; they will comply with search warrants, but in the least helpful way possible and they will fight it,” he says. “It’s possible the delay was just getting through that legal process, properly worded court orders, and Google’s lawyers fighting it.”

However, he says that this seems unlikely, given the high-profile nature of the case. Additionally, reports indicate it took Google’s engineers “several days” to recover the footage.

But it’s an important point for those concerned about their data being accessible after it’s been deleted. While it was technically possible in this case, it’s highly unlikely to happen regularly. Barreiro believes this is “absolutely not something Google would do in a typical case.”

Ring, which also stores its video in the cloud, told me that the concept of “residual data” is not familiar to them. “We have run into this issue when folks have deleted footage and asked us if we can help get it back,” Ring spokesperson Emma Daniels said. “But it’s gone.”

While this case shows recovery is technically possible, it also shows it’s rare, resource-intensive, and reserved for extraordinary circumstances. But if the idea makes you uneasy, you can reduce your risk by using local storage that you control and/or a cloud service that offers end-to-end encryption, which means not even the provider can access your footage.