Importance of Audio Authentication
The process for authentication of digital audio recordings determines whether or not the recorded events were captured with integrity as well as can determine if the recording has been tampered with. In this age of digital audio, edits can be made and covered up very easily. There are free versions of audio editing software – such as Audacity – which are available online and can make edits that alter the events or conversations that originally occurred in digital audio recordings. In addition to editing applications, many recording devices like iPhones have editing capabilities directly in the VoiceMemo app. These devices will leave behind clues that we analyze to determine the authenticity of a recording.
What we are seeing more of with the surplus of recorded audio evidence is simply mishandling of the recordings. Digital recordings are fragile by nature and contain delicate information that if not handled properly, can be stripped, altered, or deleted. This information is oftentimes crucial for investigation by an audio expert or the trier of fact. When we provide authentication of digital audio recordings services, the first step is to establish a chain of custody. While it is the first step, a chain of custody does not, in and of itself, establish a recording as being authentic. I have seen audio evidence that was not authentic and was stored in a digital audio recorder.
So why is audio authentication so important? What should an examiner be aware of when examining audio evidence? What is the process of examining and authenticating audio evidence for courtroom use? If audio evidence is found to be altered, it should be ruled inadmissible in court because it is not an accurate representation of the events that occurred.
How to authenticate an audio recording?
First, establish and determine the chain of custody. If the expert is able to retrieve the evidence from the original source, in most cases that will automatically create and establish an authentic chain of custody. Or, provide clues of tampering if the recording was edited and re-recorded. If it’s not possible for the forensic expert to retrieve the recording, then the forensic expert must carefully go through all of the documents and reports that arrived with the evidence.
Sometimes a chain of custody log from law enforcement will be included, which will strengthen the authenticity of the audio evidence. But if the chain of custody cannot be established, the forensic examiner must rely on other techniques as well as their own expertise to determine the authenticity of the evidence. If further investigation reveals more inconsistencies in the recording and metadata, more often than not that recording is determined to be altered.
Digital audio recorders aren’t the only equipment that record audio evidence. CCTV surveillance systems, as well as most other digital video recorders, will include both audio and video in the recordings. As an audio and video forensic expert, I often work with both the video and audio from these recordings.
When an expert receives digital media evidence that includes sight and sound, they should analyze both audio and video using separate forensic processes. I have come across cases in which the video was unedited but the audio had been tampered with. In this case, I was unable to authenticate the evidence because a chain of custody could not be established. Plus, there were anomalies in the audio that could be measured, heard, and documented.
Digital Integrity Analysis
Metadata & HEX Analysis
When I first began working as an audio forensic expert, most of my work was with analog audio evidence in the form of mini, micro, and standard audio cassettes. I did have some cases where reel to reel tape was used.
Today almost all recordings are recorded digitally and there is important information from the recording process that must be analyzed when performing an audio authentication. Digital audio recordings contain digital information that reveals information about how the recording was made and the type of equipment that created the recording.
This digital information includes meta data, EXIF (exchangeable image file format) data as well as hexidecimal data. If a recording was loaded into a software program capable of performing edits, there will often be a footprint left in the recording HEX information showing what software was used.
When examining the digital information, it is necessary to create an exemplar recording to compare the metadata with the original. An exemplar is a recording that is made in conditions that are as close to the original recording as possible, which include the same equipment and recording environment. Using this exemplar, the forensic expert can compare the metadata and HEX information of the two files. If there are inconsistencies in the data, that can also be a sign of tampering.
For a forensic expert to authenticate a piece of audio evidence, the expert must prove beyond any doubt that the recording is in its original form and has not undergone any tampering. If a piece of evidence is not authentic, it should not be used in court because it may be incomplete or altered to purport events that did not occur.
LTAS, Recording Parameters (Global Analysis)
After critical listening, the forensic expert must use electronic measurement to examine the audio evidence. This is done by noting the prominent frequencies in the voices or other sound source and the noise floor. The levels of the recording and of the different frequencies can be measured as well.
Tools such as spectrograms, frequency analysis windows, and level meters are very helpful for observing and collecting this information. The expert should note the frequency range of the overall recording, the voices or conversation, and the noise floor or extraneous sounds in the recording.
If the frequency range of a voice suddenly becomes larger or smaller or shifts in frequency range, that can be a sign of an edit. Sudden, unexplained changes in the noise floor level, as well as the sudden presence of another background noise, can also be a sign of an edit. As I mentioned before, I have come across recordings in which I could hear two noise floors. This can often be measured and seen in a spectrogram and a frequency analysis panel.
Spectrographic Analysis (Local Analysis)
Visually inspecting the audio waveform and spectrogram is the next step in authenticating the audio. This goes hand in hand with the electronic measurement as the forensic expert analyzes the physical wave properties and frequency information. Waveforms are continuous and smooth when examined very closely.
Even an abrupt, loud sound like a clap will have a smooth, continuous wave. If there are sudden breaks in the waveform of a recording, these are signs of editing. The expert should also pay close attention to the phasing of the waveform. This can also be seen when visually zooming in to the waveform. If the waveform of the recording is suddenly inverted, this can also mean an edit was made.
The spectrogram will display the full frequency spectrum with warmer or colder colors representing the strength of that frequency. The noise floor can be seen very clearly in this view, helping to identify breaks in the sound. All recordings have some noise floor, even if they are almost inaudible. When viewing the spectrogram, any breaks in the noise floor may be signs of an edit. Changes in the volume of the noise floor can also be a sign of an edit.