The Nancy Guthrie suspect tried to vanish by powering down his phone. Unfortunately for him, it backfired spectacularly

The person who abducted Nancy Guthrie may have actually left a major clue for investigators by trying to hide their digital footprint. Digital forensics expert Heather Barnhart, who helped crack the Idaho student murder case, says that even turning off a phone can become “the loudest evidence.”

Barnhart, who works with Cellebrite and the SANS Institute, explained that criminals often underestimate how hard it is to truly disappear in a connected world. According to Fox News, she previously analyzed the phone and computer of convicted killer Bryan Kohberger. While authorities haven’t shared many details about the digital evidence in the Guthrie case, Barnhart believes that cell tower data, Wi-Fi logs, and other digital trails could be critical.

Nancy Guthrie, the 84-year-old mother of Today co-host Savannah Guthrie, is believed to have been taken from her Tucson home against her will around 2:30 AM on February 1, 2026. The suspect, or suspects, wore a ski mask, gloves, and long-sleeved clothing to avoid leaving traceable DNA inside the home. Traditional DNA leads have since hit dead ends, making digital evidence even more important.

Turning off a phone in the early morning hours creates an unusual pattern that investigators can easily spot

Barnhart pointed to Kohberger as a clear example of how trying to hide can backfire. He created “bookends” around his crime by turning off his device right before the murders and turning it back on about 40 minutes later. This deliberate act, combined with other attempts to erase his digital footprint, essentially created a “tunnel” for investigators to focus on. Investigators have also been uncovering chilling details about the suspect’s behavior in the Guthrie case.

Even a temporary digital blackout can stand out, especially in a quiet residential neighborhood in the early morning hours. Most devices would be stationary at 2:30 AM, with their owners asleep. If a device suddenly goes dark, it creates an unusual pattern that investigators can spot.

Investigators can look for unusual behavior patterns. If a suspect scoped out the area beforehand, their phone would have pinged local towers. Even if it was off during the abduction, it would eventually be turned back on, leaving “proximity pings” or “entry and exit” data. Barnhart also found during the Kohberger case that a device on airplane mode can still leave a trace, such as when her own device pinged in a new location after she crossed time zones.

Beyond cell tower data, investigators might also check if a suspect’s phone “touched” Guthrie’s home Wi-Fi network. Even without connecting, simply being in range could place the device at the scene. Traffic cameras are another tool that could provide useful footage, though it is unclear what authorities have found so far. The case has taken another serious turn, as the FBI believes Guthrie was taken across the border with a new ransom demand also surfacing.

“With Bryan Kohberger, he disabled cellular, disabled Wi-Fi and turned off his phone,” Barnhart said. “That is extreme measures to not have a digital footprint. So he really took all the steps but still made a mistake… We hope in Nancy Guthrie, that whoever has her made a mistake and that we can uncover that footprint.”