Nancy Guthrie, the 84-year-old mother of Today Show host Savannah Guthrie, was taken from her home in the Catalina Foothills of Arizona in the early morning hours of February 1 by a masked, armed man captured on doorbell footage.
She has been missing ever since, and investigators believe she was taken against her will. The Pima County Sheriff's Department and the FBI are treating her disappearance as a suspected kidnapping.
The Sun reported that a digital forensics expert who helped crack the Bryan Kohberger murder case says she believes the same kind of investigative tools could unravel whatever happened to Nancy Guthrie.
Heather Barnhart, Senior Director of Forensic Research at Cellebrite, previously worked on the case against Bryan Kohberger in the 2022 killings of four University of Idaho students, where her analysis of cellphone and device data helped reconstruct Kohberger's movements before and after the murders.
She has been following the Nancy Guthrie case closely and laid out how digital evidence may prove decisive.
Barnhart said she believes forensic experts are already involved:
"I believe there are [data] forensic experts involved and helping out."
The investigative avenues she described are striking in their specificity. Alleged abductors initially demanded a $6 million ransom in Bitcoin, and Barnhart outlined how that demand alone opens a thread. Email origin tracing, subpoenas to platforms like ChatGPT and Google, and AI chat logs all become viable tools when a ransom note enters the picture.
"From law enforcement perspective, chasing email. So, looking at that email address and reversing it back to where it originated, could be huge in finding these people."
This is where the investigation potentially gets interesting. Barnhart explained that if the person who wrote the ransom note used any AI tool in composing it, those interactions leave a recoverable trail:
"If the person writing the ransom note used open AI in any way, those logs are completely available on servers. So law enforcement could scan for AI chat logs with those exact words from those random notes and potentially tie it back to an IP address leading to someone's home, which I think could be really unique."
In other words, the very tools criminals might use to sound more sophisticated could be what gives them away. There is a certain poetic justice in that.
Barnhart also addressed the Bitcoin ransom demand, noting that she was asked during the Kohberger case not to educate the public on exactly how the FBI traces cryptocurrency. But she made the core principle clear: activity is traceable.
"And the second someone makes that choice, I don't want to call it an error, makes that choice, it activates a whole new investigation … is a good way of saying it. But I think people initially wanted Bitcoin instead of just getting paid by the FBI, that amount, the award, they thought it would help them remain anonymous."
The assumption that Bitcoin equals anonymity is one of the great misconceptions of modern crime. Barnhart's restraint in describing the FBI's methods speaks volumes. She said enough to suggest that anyone who tries to collect that ransom will leave a digital trail that investigators can follow.
Her gut instinct is that the first ransom note was real, though she believes there have been many copycats since. That tracks with the nature of high-profile cases. Once a story goes national, the grifters and attention-seekers flood the zone, which is precisely why Barnhart cautioned against sharing too much publicly:
"I think anything like that, they probably shouldn't give the public too much information on, just because what if another ransom note is coming? I also don't want to overeducate."
On the physical forensics side, the picture is murkier. Investigators recovered DNA evidence from Nancy's home and nearby areas, including gloves found about two miles away that match those worn by the masked man seen on video.
But lab tests show that these samples do not match any profiles in the FBI's CODIS database and are also different from DNA found inside her home. Some of the samples are described as low-level.
That is a significant obstacle. A CODIS miss means the suspect, or at least the person who left those samples, has no prior criminal profile in the system. It does not mean the DNA is useless. It means it becomes valuable only once investigators identify a person of interest through other means.
This is exactly why Barnhart emphasized the primacy of digital evidence:
"DNA is absolutely a fabulous forensic artifact that leads to people of interest. Digital evidence is what seals the case. And it takes a long time."
Neighbors have shared new surveillance footage showing several vehicles driving near Guthrie's home, adding to the pile of data investigators must sift through.
Law enforcement recently returned Nancy's home to her family after a thorough sweep, and authorities have scaled back daily public updates, saying they will share new information only when warranted.
Barnhart stressed the importance of bringing specialized experts into different aspects of the investigation rather than relying on any single analyst to handle everything. She framed it bluntly:
"And if you have an agency where I say, 'Hi, I'm Heather, and I can do all of these things for you', that's dangerous. So you need a lot of hands in the investigation, but the key is communication and not battling."
That last point is worth noting. Interagency turf wars have derailed investigations before. When the Pima County Sheriff's Department and the FBI are both deeply involved, communication between those teams is not a nicety. It is the architecture of the case.
Barnhart expressed confidence that whoever did this left something behind:
"I think every criminal makes a mistake. They do. There is not a perfect crime. There is going to be a hair, a trace of DNA, a digital footprint, a camera that caught you, something will be left behind. But every single digital trace has to be looked at by investigators, because you never know, again, what that one thread is that will unravel the entire investigation."
Savannah Guthrie is set to return to work on the Today Show after spending weeks helping with the search and publicizing appeals for information. That return carries a weight that no television camera can fully convey.
Her mother, an 84-year-old woman, was pulled from her home by force in the middle of the night, and a month later, authorities are still struggling to identify the masked man on the doorbell footage.
The digital forensics trail may ultimately be what breaks this open. Phone data, email metadata, AI chat logs, cryptocurrency movements, surveillance footage. Barnhart captured the endgame plainly:
"I think what will really solve this is any person of interest or suspect that they obtain, when they get their phone data, that phone will tell the truth of why it was done, how it was done, was it planned? It'll paint the picture."
Somewhere in the data, the truth is waiting. The question is whether investigators can reach it before time runs out for Nancy Guthrie.