Authenticating digital audio evidence and the importance of the authentication process for use in court. The chain of custody is the first step in the authentication process but does not in and of itself authenticate a piece of evidence. I have seen audio evidence that was not authentic and was stored in the original digital audio recorder that supposedly recorded it.
So why is audio authentication so important?
The authentication process determines whether or not the audio recording in question has been tampered with. In this age of digital audio, edits can be made and covered up very easily. There are free versions of audio editing software available on line that can make edits that alter the events or conversation that originally occurred in digital audio recordings. Most of the time, if an audio recording is edited after downloading to a computer and before authoring a CD, the editing can be detected by analyzing the audio file.
What is the process of authenticating digital audio evidence?
There are five steps that one must complete to properly authenticate digital audio evidence.
1. Establish a chain of custody. If the expert is able to retrieve the evidence from the original source, in most cases that will automatically create and establish a chain of custody. If it’s not possible for the forensic expert to retrieve the recording, then the forensic expert must carefully go through all of the documents and reports that arrived with the evidence. When the chain of custody cannot be established, the forensic examiner must rely on other techniques as well as their own expertise to determine the authenticity of the evidence.
2. Critically listen to the audio recording. During this process the expert should note unusual sounding sections in the recording, referred to as anomalies. They should place markers near any anomalies they hear for later reference when compiling a forensic report. Inconsistencies in sound quality, noise floor, and level of the recording are all important to pay attention to. The forensic expert should use both studio monitors and headphones with flat frequency responses to best hear everything that is going on in the recording.
3. Electronically measure aspects of the recording. The forensic expert should use the audio forensic software they have to note the frequency ranges, levels and other aspects of the recording. Marking what frequency ranges voices or other sounds are in compared to the noise floor can also help the expert better detect sudden changes and other anomalies in the recording that may indicate tampering.
4. Visually inspect the audio recording. This step will go hand in hand with electronic measurement. The forensic expert should analyze the waveform characteristics and look for any anomalies present. The expert can also use spectrum analysis and spectrograms to better see the behavior of the frequencies and detect breaks or changes in the signal or noise floor.
5. Analyze the metadata. The forensic expert will also need to inspect digital information of the recording such as the hex information, sampling rate, bit depth and file format. This will need to be compared with an exemplar recording so that anomalies can be properly detected. Digital footprints are almost always left on recordings when they are created and when they are edited using other software.
For a forensic examiner to authenticate a piece of audio evidence, the examiner must prove beyond any doubt that the recording is in its original form and has not undergone any tampering. If a piece of evidence is not authentic, it should not be used in court because it may be incomplete or altered to purport events that did not occur.