My thoughts on the cameras, based on
this article:
“'The cameras will record to the servers as long as they have internet. According to Nest, without a subscription, usually they are quickly overwritten by next images. But if the camera is disconnected, there should be nothing to overwrite on the server,' [longtime private investigator Andy Kay told Page 6]. Essentially, if someone does not have a subscription to the service, it’s almost like a livestream being sent to the server: new images override previous images. However, because this was the last image before the suspected kidnapper disconnected the camera, it’s the last thing that was sent to the server and therefore able to be recovered."
The footage we've seen is from the disconnected camera, which the perp was aware of or at least anticipated might be present. The other, later alert, reported at 2:12 a.m., is from a camera that the perp did not know was there and thus did not disconnect, allowing the footage to be overwritten. That could be a back door camera if they decided to enter through the back or it could be an interior camera, but regardless, it was one they were not aware of.
If it's from an interior camera, the window from 1:47 a.m. to 2:12 a.m. could've been spent trying to figure out a point of entry and/or pick a lock, force a sliding door, jimmy open a window, etc.
The 2:12 a.m. to 2:28 a.m. window is pretty clearly when most of the bad stuff went down.
IMO, this all points away from family. I'm totally stumped beyond that, though.