Evidence Evidence - What time was the porch video captured?

[FaviousM]

Figured I'd give this its own thread as it's an interesting question and seems to have different answers depending on how you look at it.

At face value, LE has said the camera disconnected (though it's not clear if that means physically or just from the network) at 01:47am which would imply the video must have been captured before then.

However, some folks on here (It was @warp3dwing that put me onto this idea Nancy Guthrie, 84, (mother of TODAY Show host Savannah Guthrie) missing - last seen in the Catalina foothills area on Jan 31, 2026) have done some calculations on the shadow length at various times and the results seem to more closely line up with the video being captured sometime after 2am, closer to the 02:12am 'motion detected' event.

I will say, I did a couple of rough calculations which give me mixed results if I'm honest.

• Trying the shadow length, I end up with the same result as others. Then shadow length matches with the 02:12am timing, and if it was actually at 01:47am the shadow would be 20cm shorter
• Trying using the angle of the shadow on the edge of the porch tiles gives me a result that lines up with the 01:47am timing. Using Mooncalc it gives an expected 3.75° at 01:47am (my rough calculation based on the video gave me 3.89°) vs an expected angle of 11.15° at 02:12am

I'm hoping someone can offer some alternative explanations for the shadows and timing (or maybe different measuring methodology) as, at least for me, the time the video happens vastly changes how I think of the perp's behaviour at the crime scene.

For instance, if the video was actually captured after 2am, what caused the 01:47am disconnection? Some WiFi Jammer device?

And if the video was actually closer to 01:47am, what caused the 'motion detection' event?

 

[Deleted member 272706]

Figured I'd give this its own thread as it's an interesting question and seems to have different answers depending on how you look at it.

At face value, LE has said the camera disconnected (though it's not clear if that means physically or just from the network) at 01:47am which would imply the video must have been captured before then.

However, some folks on here (It was @warp3dwing that put me onto this idea Nancy Guthrie, 84, (mother of TODAY Show host Savannah Guthrie) missing - last seen in the Catalina foothills area on Jan 31, 2026) have done some calculations on the shadow length at various times and the results seem to more closely line up with the video being captured sometime after 2am, closer to the 02:12am 'motion detected' event.

I will say, I did a couple of rough calculations which give me mixed results if I'm honest.

• Trying the shadow length, I end up with the same result as others. Then shadow length matches with the 02:12am timing, and if it was actually at 01:47am the shadow would be 20cm shorter
• Trying using the angle of the shadow on the edge of the porch tiles gives me a result that lines up with the 01:47am timing. Using Mooncalc it gives an expected 3.75° at 01:47am (my rough calculation based on the video gave me 3.89°) vs an expected angle of 11.15° at 02:12am

I'm hoping someone can offer some alternative explanations for the shadows and timing (or maybe different measuring methodology) as, at least for me, the time the video happens vastly changes how I think of the perp's behaviour at the crime scene.

For instance, if the video was actually captured after 2am, what caused the 01:47am disconnection? Some WiFi Jammer device?

And if the video was actually closer to 01:47am, what caused the 'motion detection' event?

I certainly can't say with any level of certainty which time is correct. I would be more likely to support the length-based approximation only because I found the angular difference harder to determine. It's only a few degrees between 01:47 and 02:12, and we're looking at a "blob" of a human shadow with no hard edges; e.g., it's not like a sun dial.

Corroborating a post-2am time is Havey Levin's statement claiming his LE sources told him the video was from 02:12. I don't know where a WS-permitted copy of that statement is, but if you Google "tmz harvey levin fbi video timestamp", there's a FB link with the video on it.

Additionally, the claim that the doorbell camera disconnected at 01:47 was given prior to the video being recovered from Google. Therefore, LE couldn't have been implying the camera was physically removed at 01:47 because they would've had no idea what time it was removed. They only knew that it was removed at some point. So, it must be referring to a WiFi disconnection, which would have been info recorded by Nancy's phone. This doesn't mean that the video wasn't from 01:47, but LE's statement about the disconnection doesn't mean what some people think it means, IMO.

And I'll have to leave it at that. I don't think I can say any more about this case.

 

[Ghostwheel]

Here is what I don't know. NG's Nest camera disconnected at 1:47 am. Is is normal for her Wifi to drop at any time during a 24 hour period? I have the best Wifi that is available in my very large city and I still get 3 to 30 second drops 7 or 8 time between 10 and 11 am weekdays and 4 and 5 weekdays. Sometimes they last as long as 3 minutes. If I weren't doing sensitive work where even seconds matter, I'd likely never notice, in fact my buffered video streaming I am playing in the background doesn't miss a beat. But if I check my modem and router, there were drops. If I had a camera, the wifi on it would drop 7 or 8 times from 10 am to 11 am every weekday and 4 to 5 PM every weekday. If someone spirited me away at 4:03 after the first drop of the afternoon, would anyone know or check to see if that was normal?

When people say a door cam is "disconnected", that could simply be an alert that says "Disconnected". It doesn't mean it's not functioning and as soon as it reconnects it will upload what it has, or that it might not go off and on "connected". Most door cams have a set amount of time available on their hard drive, it's just not a lot.

 

[Megnut]

I think it's straight forward. Something occurred at 1:47. Power cut, wifi jammed, etc.

2:12, an alert that movement was detected. LE probably got that from NG's phone. ('Could have been an animal' means it was an outside camera.) It was only later they were able to retrieve the video from the Cloud, and IMO that's where they got the other image/video (without backpack).

JMO

 

[Ghostwheel]

I think it's straight forward. Something occurred at 1:47. Power cut, wifi jammed, etc.

2:12, an alert that movement was detected. LE probably got that from NG's phone. ('Could have been an animal' means it was an outside camera.) It was only later they were able to retrieve the video from the Cloud, and IMO that's where they got the other image/video (without backpack).

JMO

Help me to understand. If something occurred at 1:47 (Power cut, wifi jammed, etc) and it didn't come back on (as in reconnect), how does movement get detected at 2:12? If there is no power and everything is connected to it, it all works or it doesn't. If Wifi is jammed but power is on, the only thing that might work is the firmware (what is actually ON the camera) and it cannot send an alert to anything.

If the doorbell cam was just disconnected from the wifi somehow, it still could not send an alert because no wifi. It MIGHT store a record of a person detected on the camera if it was still powered at the time (the firmware does do the sorting of motion to what type of motion), but could they get that from a crushed camera? Maybe.

If the doorbell cam was differently powered (battery), then yes, the doorbell cam could have been disconnected (destroyed, removed from the wifi, what have you) at 1:47, without anything else being cut off. Then movement being detected at 2:12 on a different camera would make sense.

Honestly, I think non computer people just don't know the right words to use. "Camera software" as he is referring to it is called firmware. It's on the camera and isn't what you would use to see anything in a normal fashion. (not something you bring up and look at images on)

From ABC Timeline
1:47 a.m.: Nancy Guthrie's doorbell camera disconnected, the sheriff said.

2:12 a.m.: The camera software detected a person on camera, but no video is available, the sheriff said. "They had no subscription and therefore it would rewrite itself, kind of -- it just kind of loops right and covers up," the sheriff said. "That's what our analysis teams have told us. We're not done with that." The sheriff said there were multiple cameras at the home.

 

[Megnut]

Help me to understand. If something occurred at 1:47 (Power cut, wifi jammed, etc) and it didn't come back on (as in reconnect), how does movement get detected at 2:12? If there is no power and everything is connected to it, it all works or it doesn't. If Wifi is jammed but power is on, the only thing that might work is the firmware (what is actually ON the camera) and it cannot send an alert to anything.

If the doorbell cam was just disconnected from the wifi somehow, it still could not send an alert because no wifi. It MIGHT store a record of a person detected on the camera if it was still powered at the time (the firmware does do the sorting of motion to what type of motion), but could they get that from a crushed camera? Maybe.

If the doorbell cam was differently powered (battery), then yes, the doorbell cam could have been disconnected (destroyed, removed from the wifi, what have you) at 1:47, without anything else being cut off. Then movement being detected at 2:12 on a different camera would make sense.

Honestly, I think non computer people just don't know the right words to use. "Camera software" as he is referring to it is called firmware. It's on the camera and isn't what you would use to see anything in a normal fashion. (not something you bring up and look at images on)

From ABC Timeline
1:47 a.m.: Nancy Guthrie's doorbell camera disconnected, the sheriff said.

2:12 a.m.: The camera software detected a person on camera, but no video is available, the sheriff said. "They had no subscription and therefore it would rewrite itself, kind of -- it just kind of loops right and covers up," the sheriff said. "That's what our analysis teams have told us. We're not done with that." The sheriff said there were multiple cameras at the home.

I don't know.

Somehow it registered on her phone (an alert) and made its way to the Cloud, from where LE ultimately recovered it.

 

[wibbleflea]

Help me to understand. If something occurred at 1:47 (Power cut, wifi jammed, etc) and it didn't come back on (as in reconnect), how does movement get detected at 2:12? If there is no power and everything is connected to it, it all works or it doesn't. If Wifi is jammed but power is on, the only thing that might work is the firmware (what is actually ON the camera) and it cannot send an alert to anything.

If the doorbell cam was just disconnected from the wifi somehow, it still could not send an alert because no wifi. It MIGHT store a record of a person detected on the camera if it was still powered at the time (the firmware does do the sorting of motion to what type of motion), but could they get that from a crushed camera? Maybe.

If the doorbell cam was differently powered (battery), then yes, the doorbell cam could have been disconnected (destroyed, removed from the wifi, what have you) at 1:47, without anything else being cut off. Then movement being detected at 2:12 on a different camera would make sense.

Honestly, I think non computer people just don't know the right words to use. "Camera software" as he is referring to it is called firmware. It's on the camera and isn't what you would use to see anything in a normal fashion. (not something you bring up and look at images on)

From ABC Timeline
1:47 a.m.: Nancy Guthrie's doorbell camera disconnected, the sheriff said.

2:12 a.m.: The camera software detected a person on camera, but no video is available, the sheriff said. "They had no subscription and therefore it would rewrite itself, kind of -- it just kind of loops right and covers up," the sheriff said. "That's what our analysis teams have told us. We're not done with that." The sheriff said there were multiple cameras at the home.

I think the iPhone got an alert from the Nest app at 2:12 saying that a person was detected. I think the sheriff is referring to the Nest app as the camera software, since it manages all the cameras and receives alerts from them all, if set up correctly. The alert could have been from any camera. That fits with TMZ’s Harvey Levin saying that the FBI told him the footage was from 2:12 am. It was likely the doorbell camera.

We don’t know what the 1:47 am alert really meant. Could have been an attempt to jam Wi-Fi or just a glitch.

The perp could have started at 2:12 am and removed the camera, only then entering through the rear door and leaving through the front with NG before the 2:28 am pacemaker alert. Total time inside: 10-15 mins.

Or: he did something at 1:47 (signal jammer), then entered, disabled the front camera at 2:12 and the left with NG. Total time inside: 30+ mins.

The first option seems more likely.

Lots of discussion about pacemaker alerts on the main thread but the consensus seems to be that the pacemaker app pulls data daily, usually in the early morning. It only alerts after a few failed attempts.

It doesn’t alert if you go out of range at other times. So the 2:28 am alert likely means it was unable to do its daily data retrieval by then, but it doesn’t necessarily mean 2:28 was the time of disconnection.

 

[Lebowski]

...

It doesn’t alert if you go out of range at other times. So the 2:28 am alert likely means it was unable to do its daily data retrieval by then, but it doesn’t necessarily mean 2:28 was the time of disconnection.

sbm

minor, circumstantial point, but one would think an automatic daily retrieval would be set to a nice, round number like 2:30, not a random one like 2:28

obviously not a hard rule though. plus, clocks might not be totally synced, etc.

 

[wibbleflea]

sbm

minor, circumstantial point, but one would think an automatic daily retrieval would be set to a nice, round number like 2:30, not a random one like 2:28

obviously not a hard rule though. plus, clocks might not be totally synced, etc.

I wondered about that, too. It might have been set for 2 am or 2:15 am, with the alert arriving only after three failed attempts, say, slightly spaced.

From the Q&A section of one of these types of pacemaker:

“These checks usually happen during the night while you are sleeping. Keep your smartphone near you (within 5 feet or 1.5 meters) when you sleep. If you are not near your smartphone at that time, the app will periodically try again and will notify you if there is a problem connecting with your heart monitor.”

So maybe that explains the odd time. Not sure!

 

[Ghostwheel]

I think the iPhone got an alert from the Nest app at 2:12 saying that a person was detected. I think the sheriff is referring to the Nest app as the camera software, since it manages all the cameras and receives alerts from them all, if set up correctly. The alert could have been from any camera. That fits with TMZ’s Harvey Levin saying that the FBI told him the footage was from 2:12 am. It was likely the doorbell camera.

We don’t know what the 1:47 am alert really meant. Could have been an attempt to jam Wi-Fi or just a glitch.

The perp could have started at 2:12 am and removed the camera, only then entering through the rear door and leaving through the front with NG before the 2:28 am pacemaker alert. Total time inside: 10-15 mins.

Or: he did something at 1:47 (signal jammer), then entered, disabled the front camera at 2:12 and the left with NG. Total time inside: 30+ mins.

The first option seems more likely.

Lots of discussion about pacemaker alerts on the main thread but the consensus seems to be that the pacemaker app pulls data daily, usually in the early morning. It only alerts after a few failed attempts.

It doesn’t alert if you go out of range at other times. So the 2:28 am alert likely means it was unable to do its daily data retrieval by then, but it doesn’t necessarily mean 2:28 was the time of disconnection.

If I consider everything, if the doorbell cam was disconnected (from what?) At 1:47, it could not send a signal at 2:12 unless it reconnected.

If I choose to only consider 1:47 , then the motion detection of a person at 2:12 doesnt matter.

Or if I only consider 2:12 (1:47 was bogus and nothing disconnected) then when did the camera get smashed? We seem to be missing a disconnection of some kind.

Is the assumption that the doorbell camera was removed with the foliage? As in, 1:47 means nothing, person was moving at 2:12 at front door destroyed camera, then went in the back door? And no other cameras caught that?

If an alert can be sent, there is no disconnection. If there is no disconnection, there should have been more than one alert if the suspect did not go in the front door. That is what see.

Something is missing here, imo.

 

[wibbleflea]

If I consider everything, if the doorbell cam was disconnected (from what?) At 1:47, it could not send a signal at 2:12 unless it reconnected.

If I choose to only consider 1:47 , then the motion detection of a person at 2:12 doesnt matter.

Or if I only consider 2:12 (1:47 was bogus and nothing disconnected) then when did the camera get smashed? We seem to be missing a disconnection of some kind.

Is the assumption that the doorbell camera was removed with the foliage? As in, 1:47 means nothing, person was moving at 2:12 at front door destroyed camera, then went in the back door? And no other cameras caught that?

If an alert can be sent, there is no disconnection. If there is no disconnection, there should have been more than one alert if the suspect did not go in the front door. That is what see.

Something is missing here, imo.

The disconnection alert comes from the app noticing the camera falling off the network. I’m assuming the reconnection hasn’t been reported to us, on the basis that if NG had an older Nest wired doorbell cam (1st gen) that didn’t report reconnections, we’d have seen traces of the wires. As you say, the doorbell camera was connected later in order send the footage. One person on the main thread reports fairly frequent disconnection alerts with his Nest cameras.

Of all the camera events and data, the 1:47 is the odd one out. Could be a network issue with that camera, could be a Wi-Fi signal jammer, could be a temporary power cut. But if it was really the doorbell camera disconnecting, you’re right to say it reconnected later and sent an alert. Perhaps we haven’t been told.