Audio Tampering and Malicious Editing Analysis

Determining whether an audio recording has been tampered with or edited in some way is not a simple process of listening to it for jumps in the conversation on playback. There are many characteristics which while not audible, are clearly observable by other means, including a visual analysis of the audio waveform in both the time and frequency domains.

The analysis is broken down into two key areas – Authentication and Integrity assessments.

Authentication Assessment

An Authenticity assessment can provide verification of the source recording device, the mode of recording and date and time the recording took place. If any of these “external characteristics” do not correlate with that which is observed in the file being assessed, then there is a strong probability that the recording did not originate from the claimed device or was made at the claimed time. These finding then provide a strong argument for or against the reliability of the recording and whether it supports the claimed origins.

Integrity Assessment

An Integrity assessment looks at the content of the recording to determine whether the audio is reliably representing the situation it is being relied upon to portray. Any characteristics not expected for the type of audio format that the claimed device uses such as unusual or varied quantisation or compression levels, sudden changes in background noise levels etc. can identify if the audio has in some way been altered or staged.

Key Audio Authentication and Integrity Assessments

Provenance

Identifying the origins or provenance of an audio file is the first step towards verifying whether the source and date/time of the recording is as claimed. This information is often lost or overwritten when a multimedia file is edited or transcoded into another format.

Audio Recording Specifications

Does the audio bandwidth, sampling rate, quantisation levels, number of channels etc. conform to the capabilities of the device claimed to have made.

Noise Levels and Structure

Is there continuity in the recordings level and makeup of background noise.

Encoding and Compression Algorithms

Does the audio recording utilise the same encoding and compression algorithms as the claimed device.

File Metadata

Audio recordings almost always includes some metadata within the file that can assist in the identification of many characteristics associated with the device used and some of the settings employed.

Missing metadata may of itself indicate that the audio recording has been modified and can no longer be considered a true duplicate copy of the original recording.

Audio Tampering and Malicious Editing Analysis can Include:

• Identification of quantisation levels used and continuity of levels.
• Analysis of the consistency and makeup or variations in background noise levels.
• Identification of any sudden waveform phase changes.
• Inspection of sampling rate, bit rate and word size for indications of prior format usage and structure.
• Inspection of audio bandwidth responses and continuity of spectral components and any filtering applied.
• Analysis of power supply or other external source induced tones and spectral components.
• Analysis of the audio stream’s structural integrity i.e. frame count continuity, dropped, missing or out-of-order frames or packets and timestamp discrepancies.