The individual responsible for abducting Nancy Guthrie may ultimately be identified using investigative techniques similar to those that proved pivotal in the case against Idaho killer Bryan Kohberger, according to a digital forensics expert who previously analyzed Kohberger’s phone data.

Authorities are currently examining extensive cellular records following the disappearance of Nancy, the elderly mother of Today show host Savannah Guthrie. She was taken from her Tucson, Arizona home in the early hours of February 1. Investigators believe the abduction occurred sometime between 1:47 a.m., when her doorbell camera was disabled, and 2:28 a.m., when her pacemaker monitoring app stopped transmitting data from her phone. Drops of blood were reportedly found on her front porch, and chilling footage from her Nest doorbell showed a masked individual standing at her front door before the device was disconnected.

Now, FBI agents — particularly members of the Cellular Analysis Survey Team (CAST) — are combing through cell tower data covering a broad radius around Nancy’s home. Their goal is to establish what constitutes “normal” cellular activity in the area and then pinpoint anomalies. According to Heather Barnhart, a digital forensics specialist affiliated with Cellebrite and the SANS Institute, identifying deviations from routine patterns is often the key to solving crimes.

Barnhart explained that while many criminals have learned to switch off their phones while committing offenses to avoid detection, they may not realize that this action itself can create a suspicious digital footprint. Phones typically maintain constant communication with nearby cell towers, even when not actively in use. When a device suddenly goes dark during a critical time window — and then reconnects shortly afterward — that interruption can stand out to investigators reviewing historical data.

In the Kohberger case, for example, his phone was powered off during the timeframe when four University of Idaho students were murdered at a residence on King Road. The device was inactive between approximately 2:54 a.m. and 4:48 a.m., meaning it did not register with the nearest tower during the attack. However, once he left the scene and turned his phone back on — likely for navigation — it began pinging towers again. That gap in connectivity, combined with subsequent movement patterns, became an important piece of evidence.

Investigators in Nancy’s case are likely applying a similar strategy. Rather than focusing solely on towers immediately adjacent to her home, they will analyze data from a wider network, including routes leading in and out of her neighborhood. They will look for phones that were inactive during the suspected time of the abduction and then suddenly reconnected, particularly devices that appear to have been traveling away from the area. Phones not typically associated with the neighborhood — especially out-of-area numbers — may draw additional scrutiny.

Another critical avenue of investigation involves the possibility of reconnaissance. Authorities have asked neighbors to review security footage dating back to January 1, suggesting they believe the suspect may have visited the area before the crime. Barnhart noted that repeated pings from a device that does not normally belong in the neighborhood could indicate surveillance activity. She referenced a previous robbery case in which law enforcement identified the perpetrator after discovering his phone had pinged towers in the area multiple times before and after the offense.

Digital forensics, however, is painstaking and time-consuming. Investigators must process massive volumes of data from multiple cellular providers such as Verizon, AT&T, and T-Mobile, each of which stores tower records in different formats. Analysts must normalize and interpret the data to construct a coherent timeline. This meticulous work can take weeks or even months, particularly if the geographic area contains numerous devices.

In Nancy’s case, the relatively rural setting of her home could simplify the process, as fewer devices may have been active compared to a densely populated urban environment. However, limited cell service in the area could introduce complications. Even so, Barnhart emphasized that phones constantly emit beacon signals searching for available towers, meaning investigators can still track when and where devices attempted to connect.

Ultimately, by mapping normal cellular behavior and isolating devices that behaved unusually — such as going dark at a critical moment or appearing repeatedly in the vicinity without explanation — authorities may uncover the digital trail leading to Nancy’s abductor.