LE had released the scene early Monday, Feb 2 (assuming 20 hours of processing after noon or so Sunday, Feb 1) but the first of the ransom notes was received Monday afternoon, Feb 3. Since the ransom note (although delivered other than at NG’s home) may have been connected, it seems reasonable that LE would consider it evidence potentially related to the initial crime (breaking and entering and abduction, at least) and so would re-close the crime scene and revisit the site with that new mind frame. And things that may have escaped detection as relevant evidence with initial processing (the loose pile of Lantana at the front door of a meticulously-maintained home and landscape and evidence of a bit of the same tucked behind the camera mount), the camera atop the roof of the guest house, consideration of the possibility that NG’s car may have been used) would not have had to wait until Google managed to recover video previously thought lost and unrecoverable.
And given the ransom notes (indicating a perpetrator potentially attempting communication and manipulation), it completely defies reason that the Amazon envelope delivered after processing sat there inside the front entryway so long. What if the contents were sent by the perpetrator - possibly using NG’s account having been ordered when inside NG’s home? (Maybe LE did check the Amazon order and knew it was unrelated…but if not, why not open it?) And, given ransom demands indicating potential communication and manipulation by the perpetrator(s), why wouldn’t LE also be collecting and considering any mail delivered to NG’s mailbox (maybe they were…but seems likely not considering the house remained released.)