Evidence Evidence - What time was the porch video captured?

[FaviousM]

Figured I'd give this its own thread as it's an interesting question and seems to have different answers depending on how you look at it.

At face value, LE has said the camera disconnected (though it's not clear if that means physically or just from the network) at 01:47am which would imply the video must have been captured before then.

However, some folks on here (It was @warp3dwing that put me onto this idea Nancy Guthrie, 84, (mother of TODAY Show host Savannah Guthrie) missing - last seen in the Catalina foothills area on Jan 31, 2026) have done some calculations on the shadow length at various times and the results seem to more closely line up with the video being captured sometime after 2am, closer to the 02:12am 'motion detected' event.

I will say, I did a couple of rough calculations which give me mixed results if I'm honest.

• Trying the shadow length, I end up with the same result as others. Then shadow length matches with the 02:12am timing, and if it was actually at 01:47am the shadow would be 20cm shorter
• Trying using the angle of the shadow on the edge of the porch tiles gives me a result that lines up with the 01:47am timing. Using Mooncalc it gives an expected 3.75° at 01:47am (my rough calculation based on the video gave me 3.89°) vs an expected angle of 11.15° at 02:12am

I'm hoping someone can offer some alternative explanations for the shadows and timing (or maybe different measuring methodology) as, at least for me, the time the video happens vastly changes how I think of the perp's behaviour at the crime scene.

For instance, if the video was actually captured after 2am, what caused the 01:47am disconnection? Some WiFi Jammer device?

And if the video was actually closer to 01:47am, what caused the 'motion detection' event?

 

[Deleted member 272706]

Figured I'd give this its own thread as it's an interesting question and seems to have different answers depending on how you look at it.

At face value, LE has said the camera disconnected (though it's not clear if that means physically or just from the network) at 01:47am which would imply the video must have been captured before then.

However, some folks on here (It was @warp3dwing that put me onto this idea Nancy Guthrie, 84, (mother of TODAY Show host Savannah Guthrie) missing - last seen in the Catalina foothills area on Jan 31, 2026) have done some calculations on the shadow length at various times and the results seem to more closely line up with the video being captured sometime after 2am, closer to the 02:12am 'motion detected' event.

I will say, I did a couple of rough calculations which give me mixed results if I'm honest.

• Trying the shadow length, I end up with the same result as others. Then shadow length matches with the 02:12am timing, and if it was actually at 01:47am the shadow would be 20cm shorter
• Trying using the angle of the shadow on the edge of the porch tiles gives me a result that lines up with the 01:47am timing. Using Mooncalc it gives an expected 3.75° at 01:47am (my rough calculation based on the video gave me 3.89°) vs an expected angle of 11.15° at 02:12am

I'm hoping someone can offer some alternative explanations for the shadows and timing (or maybe different measuring methodology) as, at least for me, the time the video happens vastly changes how I think of the perp's behaviour at the crime scene.

For instance, if the video was actually captured after 2am, what caused the 01:47am disconnection? Some WiFi Jammer device?

And if the video was actually closer to 01:47am, what caused the 'motion detection' event?

I certainly can't say with any level of certainty which time is correct. I would be more likely to support the length-based approximation only because I found the angular difference harder to determine. It's only a few degrees between 01:47 and 02:12, and we're looking at a "blob" of a human shadow with no hard edges; e.g., it's not like a sun dial.

Corroborating a post-2am time is Havey Levin's statement claiming his LE sources told him the video was from 02:12. I don't know where a WS-permitted copy of that statement is, but if you Google "tmz harvey levin fbi video timestamp", there's a FB link with the video on it.

Additionally, the claim that the doorbell camera disconnected at 01:47 was given prior to the video being recovered from Google. Therefore, LE couldn't have been implying the camera was physically removed at 01:47 because they would've had no idea what time it was removed. They only knew that it was removed at some point. So, it must be referring to a WiFi disconnection, which would have been info recorded by Nancy's phone. This doesn't mean that the video wasn't from 01:47, but LE's statement about the disconnection doesn't mean what some people think it means, IMO.

And I'll have to leave it at that. I don't think I can say any more about this case.

 

[Ghostwheel]

Here is what I don't know. NG's Nest camera disconnected at 1:47 am. Is is normal for her Wifi to drop at any time during a 24 hour period? I have the best Wifi that is available in my very large city and I still get 3 to 30 second drops 7 or 8 time between 10 and 11 am weekdays and 4 and 5 weekdays. Sometimes they last as long as 3 minutes. If I weren't doing sensitive work where even seconds matter, I'd likely never notice, in fact my buffered video streaming I am playing in the background doesn't miss a beat. But if I check my modem and router, there were drops. If I had a camera, the wifi on it would drop 7 or 8 times from 10 am to 11 am every weekday and 4 to 5 PM every weekday. If someone spirited me away at 4:03 after the first drop of the afternoon, would anyone know or check to see if that was normal?

When people say a door cam is "disconnected", that could simply be an alert that says "Disconnected". It doesn't mean it's not functioning and as soon as it reconnects it will upload what it has, or that it might not go off and on "connected". Most door cams have a set amount of time available on their hard drive, it's just not a lot.

 

[Megnut]

I think it's straight forward. Something occurred at 1:47. Power cut, wifi jammed, etc.

2:12, an alert that movement was detected. LE probably got that from NG's phone. ('Could have been an animal' means it was an outside camera.) It was only later they were able to retrieve the video from the Cloud, and IMO that's where they got the other image/video (without backpack).

JMO

 

[Ghostwheel]

I think it's straight forward. Something occurred at 1:47. Power cut, wifi jammed, etc.

2:12, an alert that movement was detected. LE probably got that from NG's phone. ('Could have been an animal' means it was an outside camera.) It was only later they were able to retrieve the video from the Cloud, and IMO that's where they got the other image/video (without backpack).

JMO

Help me to understand. If something occurred at 1:47 (Power cut, wifi jammed, etc) and it didn't come back on (as in reconnect), how does movement get detected at 2:12? If there is no power and everything is connected to it, it all works or it doesn't. If Wifi is jammed but power is on, the only thing that might work is the firmware (what is actually ON the camera) and it cannot send an alert to anything.

If the doorbell cam was just disconnected from the wifi somehow, it still could not send an alert because no wifi. It MIGHT store a record of a person detected on the camera if it was still powered at the time (the firmware does do the sorting of motion to what type of motion), but could they get that from a crushed camera? Maybe.

If the doorbell cam was differently powered (battery), then yes, the doorbell cam could have been disconnected (destroyed, removed from the wifi, what have you) at 1:47, without anything else being cut off. Then movement being detected at 2:12 on a different camera would make sense.

Honestly, I think non computer people just don't know the right words to use. "Camera software" as he is referring to it is called firmware. It's on the camera and isn't what you would use to see anything in a normal fashion. (not something you bring up and look at images on)

From ABC Timeline
1:47 a.m.: Nancy Guthrie's doorbell camera disconnected, the sheriff said.

2:12 a.m.: The camera software detected a person on camera, but no video is available, the sheriff said. "They had no subscription and therefore it would rewrite itself, kind of -- it just kind of loops right and covers up," the sheriff said. "That's what our analysis teams have told us. We're not done with that." The sheriff said there were multiple cameras at the home.

 

[Megnut]

Help me to understand. If something occurred at 1:47 (Power cut, wifi jammed, etc) and it didn't come back on (as in reconnect), how does movement get detected at 2:12? If there is no power and everything is connected to it, it all works or it doesn't. If Wifi is jammed but power is on, the only thing that might work is the firmware (what is actually ON the camera) and it cannot send an alert to anything.

If the doorbell cam was just disconnected from the wifi somehow, it still could not send an alert because no wifi. It MIGHT store a record of a person detected on the camera if it was still powered at the time (the firmware does do the sorting of motion to what type of motion), but could they get that from a crushed camera? Maybe.

If the doorbell cam was differently powered (battery), then yes, the doorbell cam could have been disconnected (destroyed, removed from the wifi, what have you) at 1:47, without anything else being cut off. Then movement being detected at 2:12 on a different camera would make sense.

Honestly, I think non computer people just don't know the right words to use. "Camera software" as he is referring to it is called firmware. It's on the camera and isn't what you would use to see anything in a normal fashion. (not something you bring up and look at images on)

From ABC Timeline
1:47 a.m.: Nancy Guthrie's doorbell camera disconnected, the sheriff said.

2:12 a.m.: The camera software detected a person on camera, but no video is available, the sheriff said. "They had no subscription and therefore it would rewrite itself, kind of -- it just kind of loops right and covers up," the sheriff said. "That's what our analysis teams have told us. We're not done with that." The sheriff said there were multiple cameras at the home.

I don't know.

Somehow it registered on her phone (an alert) and made its way to the Cloud, from where LE ultimately recovered it.

 

[wibbleflea]

Help me to understand. If something occurred at 1:47 (Power cut, wifi jammed, etc) and it didn't come back on (as in reconnect), how does movement get detected at 2:12? If there is no power and everything is connected to it, it all works or it doesn't. If Wifi is jammed but power is on, the only thing that might work is the firmware (what is actually ON the camera) and it cannot send an alert to anything.

If the doorbell cam was just disconnected from the wifi somehow, it still could not send an alert because no wifi. It MIGHT store a record of a person detected on the camera if it was still powered at the time (the firmware does do the sorting of motion to what type of motion), but could they get that from a crushed camera? Maybe.

If the doorbell cam was differently powered (battery), then yes, the doorbell cam could have been disconnected (destroyed, removed from the wifi, what have you) at 1:47, without anything else being cut off. Then movement being detected at 2:12 on a different camera would make sense.

Honestly, I think non computer people just don't know the right words to use. "Camera software" as he is referring to it is called firmware. It's on the camera and isn't what you would use to see anything in a normal fashion. (not something you bring up and look at images on)

From ABC Timeline
1:47 a.m.: Nancy Guthrie's doorbell camera disconnected, the sheriff said.

2:12 a.m.: The camera software detected a person on camera, but no video is available, the sheriff said. "They had no subscription and therefore it would rewrite itself, kind of -- it just kind of loops right and covers up," the sheriff said. "That's what our analysis teams have told us. We're not done with that." The sheriff said there were multiple cameras at the home.

I think the iPhone got an alert from the Nest app at 2:12 saying that a person was detected. I think the sheriff is referring to the Nest app as the camera software, since it manages all the cameras and receives alerts from them all, if set up correctly. The alert could have been from any camera. That fits with TMZ’s Harvey Levin saying that the FBI told him the footage was from 2:12 am. It was likely the doorbell camera.

We don’t know what the 1:47 am alert really meant. Could have been an attempt to jam Wi-Fi or just a glitch.

The perp could have started at 2:12 am and removed the camera, only then entering through the rear door and leaving through the front with NG before the 2:28 am pacemaker alert. Total time inside: 10-15 mins.

Or: he did something at 1:47 (signal jammer), then entered, disabled the front camera at 2:12 and the left with NG. Total time inside: 30+ mins.

The first option seems more likely.

Lots of discussion about pacemaker alerts on the main thread but the consensus seems to be that the pacemaker app pulls data daily, usually in the early morning. It only alerts after a few failed attempts.

It doesn’t alert if you go out of range at other times. So the 2:28 am alert likely means it was unable to do its daily data retrieval by then, but it doesn’t necessarily mean 2:28 was the time of disconnection.

 

[Lebowski]

...

It doesn’t alert if you go out of range at other times. So the 2:28 am alert likely means it was unable to do its daily data retrieval by then, but it doesn’t necessarily mean 2:28 was the time of disconnection.

sbm

minor, circumstantial point, but one would think an automatic daily retrieval would be set to a nice, round number like 2:30, not a random one like 2:28

obviously not a hard rule though. plus, clocks might not be totally synced, etc.

 

[wibbleflea]

sbm

minor, circumstantial point, but one would think an automatic daily retrieval would be set to a nice, round number like 2:30, not a random one like 2:28

obviously not a hard rule though. plus, clocks might not be totally synced, etc.

I wondered about that, too. It might have been set for 2 am or 2:15 am, with the alert arriving only after three failed attempts, say, slightly spaced.

From the Q&A section of one of these types of pacemaker:

“These checks usually happen during the night while you are sleeping. Keep your smartphone near you (within 5 feet or 1.5 meters) when you sleep. If you are not near your smartphone at that time, the app will periodically try again and will notify you if there is a problem connecting with your heart monitor.”

So maybe that explains the odd time. Not sure!

 

[Ghostwheel]

I think the iPhone got an alert from the Nest app at 2:12 saying that a person was detected. I think the sheriff is referring to the Nest app as the camera software, since it manages all the cameras and receives alerts from them all, if set up correctly. The alert could have been from any camera. That fits with TMZ’s Harvey Levin saying that the FBI told him the footage was from 2:12 am. It was likely the doorbell camera.

We don’t know what the 1:47 am alert really meant. Could have been an attempt to jam Wi-Fi or just a glitch.

The perp could have started at 2:12 am and removed the camera, only then entering through the rear door and leaving through the front with NG before the 2:28 am pacemaker alert. Total time inside: 10-15 mins.

Or: he did something at 1:47 (signal jammer), then entered, disabled the front camera at 2:12 and the left with NG. Total time inside: 30+ mins.

The first option seems more likely.

Lots of discussion about pacemaker alerts on the main thread but the consensus seems to be that the pacemaker app pulls data daily, usually in the early morning. It only alerts after a few failed attempts.

It doesn’t alert if you go out of range at other times. So the 2:28 am alert likely means it was unable to do its daily data retrieval by then, but it doesn’t necessarily mean 2:28 was the time of disconnection.

If I consider everything, if the doorbell cam was disconnected (from what?) At 1:47, it could not send a signal at 2:12 unless it reconnected.

If I choose to only consider 1:47 , then the motion detection of a person at 2:12 doesnt matter.

Or if I only consider 2:12 (1:47 was bogus and nothing disconnected) then when did the camera get smashed? We seem to be missing a disconnection of some kind.

Is the assumption that the doorbell camera was removed with the foliage? As in, 1:47 means nothing, person was moving at 2:12 at front door destroyed camera, then went in the back door? And no other cameras caught that?

If an alert can be sent, there is no disconnection. If there is no disconnection, there should have been more than one alert if the suspect did not go in the front door. That is what see.

Something is missing here, imo.

 

[wibbleflea]

If I consider everything, if the doorbell cam was disconnected (from what?) At 1:47, it could not send a signal at 2:12 unless it reconnected.

If I choose to only consider 1:47 , then the motion detection of a person at 2:12 doesnt matter.

Or if I only consider 2:12 (1:47 was bogus and nothing disconnected) then when did the camera get smashed? We seem to be missing a disconnection of some kind.

Is the assumption that the doorbell camera was removed with the foliage? As in, 1:47 means nothing, person was moving at 2:12 at front door destroyed camera, then went in the back door? And no other cameras caught that?

If an alert can be sent, there is no disconnection. If there is no disconnection, there should have been more than one alert if the suspect did not go in the front door. That is what see.

Something is missing here, imo.

The disconnection alert comes from the app noticing the camera falling off the network. I’m assuming the reconnection hasn’t been reported to us, on the basis that if NG had an older Nest wired doorbell cam (1st gen) that didn’t report reconnections, we’d have seen traces of the wires. As you say, the doorbell camera was connected later in order send the footage. One person on the main thread reports fairly frequent disconnection alerts with his Nest cameras.

Of all the camera events and data, the 1:47 is the odd one out. Could be a network issue with that camera, could be a Wi-Fi signal jammer, could be a temporary power cut. But if it was really the doorbell camera disconnecting, you’re right to say it reconnected later and sent an alert. Perhaps we haven’t been told.

 

[Ghostwheel]

These are just for jammer reference. No evidence of a jammer has been confirmed or denied in this case. Disclaimer done.

This was an interesting article. How accurate it is I don't know.

"Google Nest Cameras, for example, will give you specific phone alerts if they think Wi-Fi jamming is happening."

Wi-Fi Jammers and Home Security: Here's What's Behind This Burglar Tech

Jamming attacks on home security are possible -- but are they really happening? Here are all the facts.

www.cnet.com

And this one from a case in Houston referenced in the article above.

"Three suspects approached a security camera holding up a backpack, which the Bellaire Police Department said likely contained a Wi-Fi jammer device.

The jammer distorted the video feed, turning what could have been clear footage into fuzzy images of little use for identifying the suspects"

But I do note, they had to be pretty close to jam the camera.

High-tech thieves use Wi-Fi jammer to disrupt Bellaire home security cameras during burglary

Three suspects approached a security camera holding up a backpack, which Bellaire Police Department told KPRC 2 News likely contained a Wi-Fi jammer device.

www.click2houston.com

 

[FaviousM]

Just to add this here as I can't edit the original post. In this article TMZ say the following

Sources directly connected to the investigation tell TMZ ... that video of the man at Nancy's door was recorded at 2:12 AM -- in other words, he's the person the software detected.

 

[Lebowski]

Just to add this here as I can't edit the original post. In this article TMZ say the following

Sources directly connected to the investigation tell TMZ ... that video of the man at Nancy's door was recorded at 2:12 AM -- in other words, he's the person the software detected.

if we take that, in conjunction with this:

1:47 a.m.: Nancy Guthrie's doorbell camera disconnected, the sheriff said.

and treat both as facts, then it seems to confirm perp(s) were on or near the scene for at least 25 minutes, which is an unusually long time, and informs theories of the crime

 

[FaviousM]

if we take that, in conjunction with this:


and treat both as facts, then it seems to confirm perp(s) were on or near the scene for at least 25 minutes, which is an unusually long time, and informs theories of the crime

Indeed. My thinking was that he showed up around 1:47am with some way to disable the camera and then he waited and watched to see if it triggered any response. And once it didn't he felt comfortable to move in

 

[OldProtozoan]

So, Kash Patel released videos and a couple of still shots. One still is just a screen capture from the video. There's a small image that I like to call 'buckethead' because that's what he looks like. The image is NOT a native nest image. It must have been cropped from a larger version. (There would not have been anything interesting in what was cropped, but pixels are important, and compression is important. JPG is a lossy compression method, and so 367X546 is pretty worthless, but its not a reflection on the nest camera, but on whoever prepared this image for release. To me it's important because it's so different. In an effort to show us the perpetrator, I believe its been grossly overexposed to bring details out from what was a dark image. As to why its so dark, I don't know. We'd need the original image and a Google nest spokesman to explain what nest mode generates such images. So, I've made many hundreds of versions of this photograph attempting to coax more details out of it. I don't know that I've been successful, but I've sure had fun. I think buckethead guy is not wearing a ski mask. I think he's got communications gear on. I think the IR light is penetrating his thin cloth mask and reflecting off his skin. So what does that mean? To me it means something more sinister, a mission, an objective, planning. And I could be entirely wrong too, LOL. So, here's the original image. A slightly darkened version, and then an all out effort to see the face. Oh, and why does the shoulder area look like an emblem. That really bothers me. 367x546 is such a tease.

 

[wibbleflea]

It’s possible that the crop wasn’t done by a person and that the image is from a notification of the sort that the Nest system sends with alerts. The alerts can be sent even when there’s no subscription. Similar stills (which haven’t been released) have been recovered from the other cameras, though not from the night of the abduction, apparently.

Interesting thought about the head covering.

 

[OldProtozoan]

AI didn’t think the size matched a nest size, but AI can be wrong. My understanding is that all images and videos came to us by Google, not from a device or a phone, but I think you’re saying this might be from Google and match might the alert format, and that might indeed be correct.

 

[Ghostwheel]

I don't know Nest specific, but I do know how night vision cameras work. The less light there is, the more the night vision relies on reflectivity of the camera's light (usually a type of Infrared-invisible to the naked eye). So color/texture/content all matter. A snapshot relies on whatever light it can get for the duration of the image capture. A longer duration (or larger camera aperture) will allow more light for the exposure. So, if this was a quick night snap with and IR camera, it's only going to get whatever light was there during the snap. A video will end up with more light due to the time it's running, the items moving around that can reflect, etc.

So imo, the image of buckethead might be on a dark night, far enough out that nothing can reflect and give more definition. But since it's probably a capture of a video or a thumbnail for a video (this is what I think it is), then it just could be a bad cobbled together image from fragments. A video thumbnail is a still image that acts as the preview image for your video. I don't think it was the same night as NG being taken as the moon was waxing gibbous at 97% .That's JMO, that part about I think, not the part about the moon. It hit full moon on Feb 1. the sky was bright all night long on Jan 31-Feb 1. On Jan 14 it was a few days past waning half, on Jan 24 it was a few days before waxing half. On the 14th it would have been dark until 5:09 am the next day, on the 24th dark by 11:59 (see moon times below)

Learn about Night vision - Google Nest Help

Google Nest cameras’ night vision uses high-power infrared (IR) LEDs to illuminate the scene when it's dark. When you set night vision to Auto, the cameras switch between normal and night modes when

support.google.com

https://www.fullmoonphase.com/north-america/united-states/tucson-moonrise-set/2026/01

https://www.fullmoonphase.com/north-america/united-states/tucson-moonrise-set/2026/02

 

[OldProtozoan]

I don't know Nest specific, but I do know how night vision cameras work. The less light there is, the more the night vision relies on reflectivity of the camera's light (usually a type of Infrared-invisible to the naked eye). So color/texture/content all matter. A snapshot relies on whatever light it can get for the duration of the image capture. A longer duration (or larger camera aperture) will allow more light for the exposure. So, if this was a quick night snap with and IR camera, it's only going to get whatever light was there during the snap. A video will end up with more light due to the time it's running, the items moving around that can reflect, etc.

So imo, the image of buckethead might be on a dark night, far enough out that nothing can reflect and give more definition. But since it's probably a capture of a video or a thumbnail for a video (this is what I think it is), then it just could be a bad cobbled together image from fragments. A video thumbnail is a still image that acts as the preview image for your video. I don't think it was the same night as NG being taken as the moon was waxing gibbous at 97% .That's JMO, that part about I think, not the part about the moon. It hit full moon on Feb 1. the sky was bright all night long on Jan 31-Feb 1. On Jan 14 it was a few days past waning half, on Jan 24 it was a few days before waxing half. On the 14th it would have been dark until 5:09 am the next day, on the 24th dark by 11:59 (see moon times below)

Learn about Night vision - Google Nest Help

Google Nest cameras’ night vision uses high-power infrared (IR) LEDs to illuminate the scene when it's dark. When you set night vision to Auto, the cameras switch between normal and night modes when

support.google.com

https://www.fullmoonphase.com/north-america/united-states/tucson-moonrise-set/2026/01

https://www.fullmoonphase.com/north-america/united-states/tucson-moonrise-set/2026/02

Yes, you're in good company. Since most of these comments were written, the FBI has put a date of 1/11 on the buckethead picture. Now, they claim it was done with Google help. So, that would confirm that the house was 'cased' before the event. A little research into the nest camera reveals that w/o a subscription the phone would get an alert, a low quality thumbnail, and record video the Google Home account. Without a subscription, the user has 3 hours to sign into the account and do something with the video, e.g. view it, or save it are options. Outside of the 3 hour window, it is unavailable. It isn't actively deleted per se, but the space in the cloud is available to be overwritten. So, if Nancy got the alert and she was sleeping, she'd not be able to do anything at 8am if the event was a 2AM. It's already be outside her window. So, Google was able to recover some stuff but not everything. What baffles me most about Buckethead is what is he doing. I'm able to 'redevelop' the image so that some parts are more visible but it just causes pareidolia. It that a face, eyes, triangle, hair, motion, a bag, a dog running around on a leash, the mind goes crazy looking at the images. AI suggests it is over-sharpening of blurry objects and artifacts from nest graphic compression, and trying to make out 'things' in what are likely low clarity desert rocks. So, moving it to 1/11 still bothers me because I can't figure out what I'm looking at. (Not buckethead, the area under buckethead's right hand appears to have 'staccato' images of something caught moving too fast for the mostly IR image. So, I agree with your suggestion that this photo is more IR than the others. It's simply bizarre. It's like looking at blurry UFO photos. The other part I think this 1/11 date suggests is 'planning'. I think Nancy was the target. They accomplished 'get Nancy' mission, and that seems bizarre to us now, but I think some group intended to be part of this media circus, and I hope we get the answers as to why they allowed this to be characterized as 'burglary gone bad' rather than stand up and say 'we did this' to further their cause.