Evidence Evidence - What time was the porch video captured?

[FaviousM]

Figured I'd give this its own thread as it's an interesting question and seems to have different answers depending on how you look at it.

At face value, LE has said the camera disconnected (though it's not clear if that means physically or just from the network) at 01:47am which would imply the video must have been captured before then.

However, some folks on here (It was @warp3dwing that put me onto this idea Nancy Guthrie, 84, (mother of TODAY Show host Savannah Guthrie) missing - last seen in the Catalina foothills area on Jan 31, 2026) have done some calculations on the shadow length at various times and the results seem to more closely line up with the video being captured sometime after 2am, closer to the 02:12am 'motion detected' event.

I will say, I did a couple of rough calculations which give me mixed results if I'm honest.

• Trying the shadow length, I end up with the same result as others. Then shadow length matches with the 02:12am timing, and if it was actually at 01:47am the shadow would be 20cm shorter
• Trying using the angle of the shadow on the edge of the porch tiles gives me a result that lines up with the 01:47am timing. Using Mooncalc it gives an expected 3.75° at 01:47am (my rough calculation based on the video gave me 3.89°) vs an expected angle of 11.15° at 02:12am

I'm hoping someone can offer some alternative explanations for the shadows and timing (or maybe different measuring methodology) as, at least for me, the time the video happens vastly changes how I think of the perp's behaviour at the crime scene.

For instance, if the video was actually captured after 2am, what caused the 01:47am disconnection? Some WiFi Jammer device?

And if the video was actually closer to 01:47am, what caused the 'motion detection' event?

 

[warp3dwing]

Figured I'd give this its own thread as it's an interesting question and seems to have different answers depending on how you look at it.

At face value, LE has said the camera disconnected (though it's not clear if that means physically or just from the network) at 01:47am which would imply the video must have been captured before then.

However, some folks on here (It was @warp3dwing that put me onto this idea Nancy Guthrie, 84, (mother of TODAY Show host Savannah Guthrie) missing - last seen in the Catalina foothills area on Jan 31, 2026) have done some calculations on the shadow length at various times and the results seem to more closely line up with the video being captured sometime after 2am, closer to the 02:12am 'motion detected' event.

I will say, I did a couple of rough calculations which give me mixed results if I'm honest.

• Trying the shadow length, I end up with the same result as others. Then shadow length matches with the 02:12am timing, and if it was actually at 01:47am the shadow would be 20cm shorter
• Trying using the angle of the shadow on the edge of the porch tiles gives me a result that lines up with the 01:47am timing. Using Mooncalc it gives an expected 3.75° at 01:47am (my rough calculation based on the video gave me 3.89°) vs an expected angle of 11.15° at 02:12am

I'm hoping someone can offer some alternative explanations for the shadows and timing (or maybe different measuring methodology) as, at least for me, the time the video happens vastly changes how I think of the perp's behaviour at the crime scene.

For instance, if the video was actually captured after 2am, what caused the 01:47am disconnection? Some WiFi Jammer device?

And if the video was actually closer to 01:47am, what caused the 'motion detection' event?

I certainly can't say with any level of certainty which time is correct. I would be more likely to support the length-based approximation only because I found the angular difference harder to determine. It's only a few degrees between 01:47 and 02:12, and we're looking at a "blob" of a human shadow with no hard edges; e.g., it's not like a sun dial.

Corroborating a post-2am time is Havey Levin's statement claiming his LE sources told him the video was from 02:12. I don't know where a WS-permitted copy of that statement is, but if you Google "tmz harvey levin fbi video timestamp", there's a FB link with the video on it.

Additionally, the claim that the doorbell camera disconnected at 01:47 was given prior to the video being recovered from Google. Therefore, LE couldn't have been implying the camera was physically removed at 01:47 because they would've had no idea what time it was removed. They only knew that it was removed at some point. So, it must be referring to a WiFi disconnection, which would have been info recorded by Nancy's phone. This doesn't mean that the video wasn't from 01:47, but LE's statement about the disconnection doesn't mean what some people think it means, IMO.

And I'll have to leave it at that. I don't think I can say any more about this case.

 

[Ghostwheel]

Here is what I don't know. NG's Nest camera disconnected at 1:47 am. Is is normal for her Wifi to drop at any time during a 24 hour period? I have the best Wifi that is available in my very large city and I still get 3 to 30 second drops 7 or 8 time between 10 and 11 am weekdays and 4 and 5 weekdays. Sometimes they last as long as 3 minutes. If I weren't doing sensitive work where even seconds matter, I'd likely never notice, in fact my buffered video streaming I am playing in the background doesn't miss a beat. But if I check my modem and router, there were drops. If I had a camera, the wifi on it would drop 7 or 8 times from 10 am to 11 am every weekday and 4 to 5 PM every weekday. If someone spirited me away at 4:03 after the first drop of the afternoon, would anyone know or check to see if that was normal?

When people say a door cam is "disconnected", that could simply be an alert that says "Disconnected". It doesn't mean it's not functioning and as soon as it reconnects it will upload what it has, or that it might not go off and on "connected". Most door cams have a set amount of time available on their hard drive, it's just not a lot.

 

[Megnut]

I think it's straight forward. Something occurred at 1:47. Power cut, wifi jammed, etc.

2:12, an alert that movement was detected. LE probably got that from NG's phone. ('Could have been an animal' means it was an outside camera.) It was only later they were able to retrieve the video from the Cloud, and IMO that's where they got the other image/video (without backpack).

JMO

 

[Ghostwheel]

I think it's straight forward. Something occurred at 1:47. Power cut, wifi jammed, etc.

2:12, an alert that movement was detected. LE probably got that from NG's phone. ('Could have been an animal' means it was an outside camera.) It was only later they were able to retrieve the video from the Cloud, and IMO that's where they got the other image/video (without backpack).

JMO

Help me to understand. If something occurred at 1:47 (Power cut, wifi jammed, etc) and it didn't come back on (as in reconnect), how does movement get detected at 2:12? If there is no power and everything is connected to it, it all works or it doesn't. If Wifi is jammed but power is on, the only thing that might work is the firmware (what is actually ON the camera) and it cannot send an alert to anything.

If the doorbell cam was just disconnected from the wifi somehow, it still could not send an alert because no wifi. It MIGHT store a record of a person detected on the camera if it was still powered at the time (the firmware does do the sorting of motion to what type of motion), but could they get that from a crushed camera? Maybe.

If the doorbell cam was differently powered (battery), then yes, the doorbell cam could have been disconnected (destroyed, removed from the wifi, what have you) at 1:47, without anything else being cut off. Then movement being detected at 2:12 on a different camera would make sense.

Honestly, I think non computer people just don't know the right words to use. "Camera software" as he is referring to it is called firmware. It's on the camera and isn't what you would use to see anything in a normal fashion. (not something you bring up and look at images on)

From ABC Timeline
1:47 a.m.: Nancy Guthrie's doorbell camera disconnected, the sheriff said.

2:12 a.m.: The camera software detected a person on camera, but no video is available, the sheriff said. "They had no subscription and therefore it would rewrite itself, kind of -- it just kind of loops right and covers up," the sheriff said. "That's what our analysis teams have told us. We're not done with that." The sheriff said there were multiple cameras at the home.

 

[Megnut]

Help me to understand. If something occurred at 1:47 (Power cut, wifi jammed, etc) and it didn't come back on (as in reconnect), how does movement get detected at 2:12? If there is no power and everything is connected to it, it all works or it doesn't. If Wifi is jammed but power is on, the only thing that might work is the firmware (what is actually ON the camera) and it cannot send an alert to anything.

If the doorbell cam was just disconnected from the wifi somehow, it still could not send an alert because no wifi. It MIGHT store a record of a person detected on the camera if it was still powered at the time (the firmware does do the sorting of motion to what type of motion), but could they get that from a crushed camera? Maybe.

If the doorbell cam was differently powered (battery), then yes, the doorbell cam could have been disconnected (destroyed, removed from the wifi, what have you) at 1:47, without anything else being cut off. Then movement being detected at 2:12 on a different camera would make sense.

Honestly, I think non computer people just don't know the right words to use. "Camera software" as he is referring to it is called firmware. It's on the camera and isn't what you would use to see anything in a normal fashion. (not something you bring up and look at images on)

From ABC Timeline
1:47 a.m.: Nancy Guthrie's doorbell camera disconnected, the sheriff said.

2:12 a.m.: The camera software detected a person on camera, but no video is available, the sheriff said. "They had no subscription and therefore it would rewrite itself, kind of -- it just kind of loops right and covers up," the sheriff said. "That's what our analysis teams have told us. We're not done with that." The sheriff said there were multiple cameras at the home.

I don't know.

Somehow it registered on her phone (an alert) and made its way to the Cloud, from where LE ultimately recovered it.