One of our day to day activities as audio forensic experts is authenticating digital audio evidence. When one of the parties in a litigation believes that an audio recording was tampered with or edited, an audio forensic expert is brought in to investigate the recording. When we authenticate an audio recording, the first step is to establish chain of custody. While it is the first step, chain of custody does not, in and of itself, establish a recording as being authentic. I have seen audio evidence that was not authentic and was stored in a digital audio recorder. So why is audio authentication so important? What should an audio forensic expert be aware of when examining audio evidence? What is the process of examining and authenticating audio evidence? I am going to answer these questions and more in the following post.
A majority of audio recordings we are hired to authenticate are created on digital audio recorders or smartphones using a recording app. These devices are easily concealed in a pocket or purse. They come in many shapes and sizes. They record various formats. One of the first steps an audio forensic expert must take when authenticating a digital audio recording is to become familiar with the equipment that created the recording
Importance of Authentication
The authentication process determines whether or not the audio recording in question has been tampered with. In this age of digital audio, edits can be made and covered up very easily. There are free versions of audio editing software – such as Audacity – which are available on line and can make edits that alter the events or conversation that originally occurred in digital audio recordings.
In the last 30 days, of all the audio authentication cases I was assigned, I found two had been edited. Both of the recordings were downloaded to a computer, edited, then played back and re-recorded through desktop computer speakers using a digital audio recorder. Most of the time, if an audio recording is edited after downloading to a computer and before authoring a CD, the editing can be detected in the digital recordings meta data. During the forensic authentication process, the software that created the edits will be detected in the HEX information of that edited recording.
If audio evidence is found to be altered, it should be ruled inadmissible in court because it is not an accurate representation of the events that occurred.
So what should the audio forensic expert be aware of during the authentication process?
First, establish and determine the chain of custody. If the expert is able to retrieve the evidence from the original source, in most cases that will automatically create and establish a chain of custody. Or, provide clues of tampering if the recording was edited and re recorded. If it’s not possible for the forensic expert to retrieve the recording, then the forensic expert must carefully go through all of the documents and reports that arrived with the evidence. Sometimes a chain of custody log from law enforcement will be included, which will strengthen the authenticity of the audio evidence. But if the chain of custody cannot be established, the forensic examiner must rely on other techniques as well as their own expertise to determine the authenticity of the evidence. If further investigation reveals more inconsistencies in the recording and metadata, more often than not that recording is determined to be altered.
Digital audio recorders aren’t the only equipment that record audio evidence. CCTV surveillance systems, as well as most other digital video recorders, will include both audio and video in the recordings. As an Audio and Video Forensic Expert, I often work with both the video and audio from these recordings. When I receive digital media evidence that includes sight and sound, I analyze both audio and video using separate forensic processes. I have come across cases in which the video was unedited but the audio had been tampered with. In this case, I was unable to authenticate the evidence because a chain of custody could not be established. Plus, there were anomalies in the audio that could be measured, heard and documented.
Process of Examining and Authenticating Audio Evidence: Critical Listening
One of the first steps that I take when audio evidence arrives at our lab, I listen critically to the entire recording a number of times. During this process I note unusual sounding sections in the recording which are called anomalies. I take notes and place markers using the forensic software so that I can find them later and include them in my forensic report.
These unusual sounding sections can be changes in the background ambience, inconsistent speech pacing and wording as well as changes in the noise floor. The noise floor is a series of natural and electronic sounds that should be consistent throughout the recording. Noise is defined as any sound source signals like hiss, hums, wind, HVAC and other sounds that are not part of the intended recording.
Critical listening must be the first step to become familiar with the audio evidence. If an edit is discovered during the critical listening phase, they are usually in the form of abrupt changes. Detecting these changes is not easy and comes with experience.
It’s important for the forensic expert to put themselves in a quiet, isolated room during critical listening so as to avoid any outside disturbances. The quiet environment enhances the critical listening focus. High quality, professional grade monitoring headphones and high quality studio monitors (speakers) are best for critical listening analysis of digital audio recordings. Professional quality headphones and speakers will have the flattest frequency response, which means they produce neutral and natural sound. This is very important for the forensic expert because subtle boosts and cuts in frequencies can impact the analysis of the digital audio recording.
Sometimes frequencies may be more audible in headphones and sound clearer to the forensic expert while other frequencies may be better heard through speakers. When the forensic expert is examining audio evidence for authentication, it is important to use both headphones and speakers to hear every aspect of the recording.
In some audio evidence I have examined, I have been able to hear a second noise floor in the recording. This usually occurs when a recording is played through speakers or an auxiliary cable into another recorder. The original noise floor from the recording is heard along with the second noise floor created from the second recording.
After critical listening, the forensic expert must use electronic measurement to examine the audio evidence. This is done by noting the prominent frequencies in the voices or other sound source and the noise floor. The levels of the recording and of the different frequencies can be measured as well. Tools such as spectrograms, frequency analysis windows and level meters are very helpful for observing and collecting this information. The expert should note the frequency range of the overall recording, the voices or conversation and the noise floor or extraneous sounds in the recording.
If the frequency range of a voice suddenly becomes larger or smaller or shifts in frequency range, that can be a sign of an edit. Sudden, unexplained changes in the noise floor level as well as the sudden presence of another background noise can also be a sign of an edit. As I mentioned before, I have come across recordings in which I could hear two noise floors. This can often be measured and seen in a spectrogram and a frequency analysis panel.
Visually inspecting the audio wave form and spectrogram is the next step in authenticating the audio. This goes hand in hand with the electronic measurement as the forensic expert analyzes the physical wave properties and frequency information. Waveforms are continuous and smooth when examined very closely. Even a quick, loud sound like a clap will have a smooth, continuous wave. If there are sudden breaks in the waveform of a recording, these are signs of editing. The expert should also pay close attention to the phasing of the waveform. This can also been seen when visually zooming in to the waveform. If the waveform of the recording is suddenly inverted, this can also mean an edit was made.
The spectrogram will show the full frequency spectrum with warmer or colder colors representing the strength of that frequency. The noise floor can be seen very clearly in this view, helping to identify breaks in the sound. All recordings have some noise floor, even if they are almost inaudible. When viewing the spectrogram, any breaks in the noise floor may be signs of an edit. Changes in the volume of the noise floor can also be a sign of an edit.
Analyzing Metadata in Digital Audio Evidence
When I first began working as an Audio Forensic Expert, most of my work was with analog audio evidence in the form of mini, micro and standard audio cassettes. I did have some cases where reel to reel tape was used. Today almost all recordings are done digitally, there is additional information that can be analyzed when performing an audio authentication. Digital audio recordings contain metadata which reveals information about how the recording was made and the type of equipment that created the recording. If a recording was loaded into a software program capable of performing edits, there will often be a footprint left in the recording HEX information showing what software was used.
When examining the digital information, it is necessary to create an exemplar recording to compare the metadata with the original. An exemplar is a recording that is made in conditions that are as close to the original recording as possible . The exemplar is made on the same kind of audio recorder and, if possible, the same environment. Using this exemplar, the forensic expert can compare the metadata and HEX information of the two files. If there are inconsistencies in the data, that can also be a sign of tampering.
For a forensic expert to authenticate a piece of audio evidence, the expert must prove beyond any doubt that the recording is in its original form and has not undergone any tampering. If a piece of evidence is not authentic, it should not be used in court because it may be incomplete or altered to purport events that did not occur.
Hopefully this post helped inform you about the authentication of digital audio recordings. If you have any questions, email us at email@example.com, or give us a call at 800-647-4291.