Introduction

An audio clip may be presented as evidence of a voice, knock, footstep or unexplained response. Before interpreting what it contains, investigators must establish what is known about the recording itself. Was it captured directly by the device? Has it been trimmed, filtered, denoised, compressed or exported through an editing application? Is the file an original, or a copy downloaded from a messaging platform?

Audio authentication is not a single test that returns “genuine” or “fake.” It is a structured assessment of provenance, file properties, signal characteristics and consistency with the claimed recording history.

Preserve before analysing

The first rule is to protect the original. Copy the file using a documented process, calculate a cryptographic hash such as SHA-256, and perform analysis on a working copy. Record who supplied the file, when it was received, how it was transferred and whether the device or original storage medium is available.

A matching hash demonstrates that two files are byte-for-byte identical. It does not prove that the recording was genuine when first created. A hash is an integrity check from the time it was calculated onward.

Metadata and file structure

Audio containers may store information about codec, sample rate, bit depth, channel count, duration, encoder and timestamps. Metadata can be incomplete, modified or stripped during export. Some fields describe the latest export rather than the original capture.

Record at least:

  • File name, size and cryptographic hash
  • Container and codec
  • Sample rate, bit depth and channel count
  • Duration and channel layout
  • Available creation or modification timestamps
  • Software used to inspect the file
  • Any known transfer, conversion or editing history

Do not treat a timestamp as proof of when an event occurred. Device clocks can be incorrect, and file systems or applications may rewrite dates.

Waveform and spectrogram examination

A waveform shows amplitude over time. It can reveal abrupt level changes, silence, clipping and obvious edits. A spectrogram displays energy across time and frequency, helping analysts inspect tonal components, broadband transients, background noise and possible discontinuities.

Potential indicators that deserve examination include:

  • Abrupt changes in room tone or background noise
  • Unnatural waveform discontinuities
  • Sudden changes in reverberation or microphone perspective
  • Repeated identical noise patterns
  • Unexpected changes in sample rate or channel characteristics
  • Compression artefacts or clipped peaks

None is conclusive alone. A door closing, automatic gain control, noise suppression or a person moving the microphone can produce changes that resemble an edit.

Compression and processing

Lossy codecs such as MP3 and AAC discard information to reduce file size. Re-encoding can introduce additional artefacts. Voice enhancement, denoising and equalisation may make a sound easier to hear but can also create misleading tonal impressions or emphasise noise.

Always retain the unprocessed source. If enhancement is necessary, document the exact software, version, settings and sequence. Present processed audio as an analytical derivative, never as a replacement for the original.

Detecting edits: a cautious approach

An edit may leave clues, but sophisticated editing can be difficult to detect and ordinary recording conditions can create false positives. Stronger authentication combines several independent lines of evidence:

  1. Original device or storage medium, where available.
  2. Documented chain of custody.
  3. Consistent file structure and metadata.
  4. Signal continuity and acoustic environment.
  5. Independent recordings of the same event.
  6. A clear account of all processing and transfers.

Specialist forensic methods may examine codec histories, electrical network frequency traces, device characteristics or edit boundaries. These methods require expertise and suitable reference data. They should not be improvised into certainty.

AERM field protocol

At capture

  • Record in an appropriate uncompressed format when possible.
  • Disable unnecessary automatic processing if the device permits.
  • Document device model, settings, microphone position and recording start time.
  • Avoid pausing or editing during a session.
  • Use a second independent recorder for important events.

After capture

  1. Preserve the original file and create a working copy.
  2. Calculate and record a SHA-256 hash.
  3. Inspect metadata without modifying the source.
  4. Generate waveform and spectrogram views.
  5. Listen at normal speed before using filters or amplification.
  6. If processing is applied, save each derivative separately and document the workflow.
  7. Maintain a log linking every derivative to its source hash.

Reporting

Separate three questions: Is the file intact since receipt? Is the file consistent with the stated capture history? What does the sound appear to contain? A positive answer to one does not automatically answer the others.

Conclusion

Forensic audio authentication is a process of preserving provenance and testing consistency, not a magic detector for fabricated recordings. Metadata, waveforms, spectrograms and signal continuity can reveal useful clues, but each has limitations. The strongest report is transparent about the original file, analytical steps, uncertainties and evidence that would be needed for a firmer conclusion.

AERM Core Principle: No anomaly is considered paranormal until environmental, psychological, technical, and scientific explanations have been systematically evaluated.

References and further reading

  1. NIST, Digital Evidence and Forensic Science resources.
  2. AES standards and technical literature on audio preservation and digital audio.
  3. EBU Tech 3285, The Broadcast Wave Format.
  4. Brixen, E. B. Audio Metering: Measurements, Standards and Practice. Focal Press.
  5. National Institute of Standards and Technology, Secure Hash Standard (FIPS 180-4).
  6. Casey, E. Digital Evidence and Computer Crime. Academic Press.

About AERM

AERM treats recordings as digital evidence requiring preservation, provenance and reproducible analysis. Interpretations are kept separate from signal observations.

Educational and safety disclaimer

This article is educational and is not a substitute for accredited forensic examination or expert testimony. Preserve original media, respect privacy and obtain consent before recording people.