Audio Forensics

What it is and why it matters

Recordings now arrive from everywhere. A phone call captured by an app, a voice note on WhatsApp, the audio track of a CCTV clip, a dictaphone left running in a meeting, a video call recorded on a laptop. The questions asked of them are the ones people asked of cassette tapes decades ago. What is being said? Is this recording complete and unaltered? Is that the voice of the person it is said to be?

Each question is a different discipline. Enhancement reduces noise and hum so that speech can be heard, but it works only with the signal that exists and aggressive processing creates sounds that were never there. Authenticity analysis looks at the file's format and metadata and at the sound itself for signs of editing, such as breaks in background noise, shifts in room acoustics or a change in the mains hum. Speaker comparison sets a questioned voice against reference recordings and reports how much the evidence supports one explanation over another. It never produces a fingerprint-style match.

Modern recordings are heavily compressed. A phone call is sampled at 8 kHz and passed through a speech codec. A voice note is encoded with Opus at a low bit rate. Compression removes exactly the fine detail that authenticity and speaker analysis depend on, and every copy made through a messaging app removes more. Getting the earliest copy, in the original container, is the first task and often the hardest.

Types of digital evidence

Speech Content
What is said, by whom and in what order, captured in a transcript that marks uncertain words instead of guessing them.
Background Sound
Traffic, doors, footsteps, other voices and room reverberation that place the recording in a setting and show whether the setting stays constant throughout.
Mains Hum
The electric network frequency, 50 Hz in India, picked up by many recorders. Its small fluctuations are continuous in an unedited recording and, where a reference database exists, can be matched to a date and time.
Encoding Details
Sample rate, bit depth, codec, bit rate and container, which should match the device and app the recording is said to come from.
File and App Metadata
Timestamps, device identifiers and the records in a messaging app's database that show when a voice note was created, sent or received.
Edit Traces
Discontinuities in the noise floor, phase jumps, duplicated segments, abrupt changes in reverberation or in the hum that point to a cut, an insertion or a re-recording.
Device Characteristics
The frequency response, automatic gain behaviour and compression artefacts of the recording device, which help to test whether the file is an original from that device.
Voice Features
Pitch, formant patterns, speech rate, accent and habits of pronunciation used in speaker comparison, read together with the recording conditions that affect them.

Devices and data sources

Smartphone voice recorder apps and call recording apps
Voice notes in WhatsApp, Telegram, Signal and similar apps, with their database records
Call centre, IVR and helpline recordings kept by organisations
Audio tracks of CCTV, body-worn and dash camera video
Dictaphones and digital voice recorders
Recordings of video calls and online meetings
Voicemail and answering machine systems
Audio shared on social media and through email
Older cassette and microcassette tapes digitised for examination

How an examination runs

The order matters. Each step protects the one after it.

01
Obtain the Earliest Copy
Ask for the file from the device that recorded it, through a forensic extraction where possible, rather than a forward or a copy played back and re-recorded. Note what generation was actually received.
02
Hash and Describe
Hash the file and record its container, codec, sample rate, bit depth, duration and every metadata field. Compare them with what the claimed device and app would produce.
03
Listen Critically
Play the whole recording with good headphones while watching the waveform and spectrogram. Mark every event, every change in background and every passage that is hard to hear.
04
Convert Without Loss
Decode to an uncompressed working copy at the original sample rate for analysis. Never process the compressed file directly and never save intermediate results in a lossy format.
05
Enhance If Asked
Apply filters one at a time, from the least aggressive, listening after each. Record the filter, its settings and the order. Stop when further processing starts to distort speech.
06
Test Authenticity If Asked
Examine the file structure for signs of editing software, then the signal for discontinuities, hum continuity, reverberation changes and duplicated material. Where an exemplar from the same device is available, compare them.
07
Compare Speakers If Asked
Obtain reference recordings of the known speaker under conditions as close as possible to the questioned one. Analyse both by listening and by measurement, and report the result as a strength of support, not a yes or no.
08
Report
Set out the recording's generation, the processing applied, the findings for each question asked and the limits imposed by the recording's quality and duration.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

Sample Rate and Bit Depth: How many times per second the sound was measured and how finely. Telephone audio at 8 kHz cannot hold frequencies above 4 kHz, which removes much of what distinguishes one voice from another.
Lossy Codec: A compression method such as AMR, AAC, MP3 or Opus that discards sound the ear is unlikely to notice. What it discards is often what an examiner needs.
Spectrogram: A picture of sound with time across, frequency up and loudness as brightness. Edits, hum and speech patterns are often easier to see here than to hear.
Noise Floor: The constant background level of a recording. A sudden change in it is one of the clearest signs of a cut.
Electric Network Frequency: The mains frequency as recorded through hum. It wanders slightly and continuously, so a jump in it suggests editing and a match against a reference record can date the recording.
Intelligibility: How much of the speech a listener can make out. Enhancement aims to raise it, and it is reported honestly, with uncertain words marked.
Speaker Comparison: The structured comparison of a questioned voice with reference recordings, combining trained listening, acoustic measurement and, where validated, automatic systems.
Likelihood Ratio: The way a comparison result is expressed. It states how much more likely the observations are if the voices are the same speaker than if they are different speakers, given the conditions.
Clipping: Distortion caused when a sound is too loud for the recorder. It flattens the waveform and the lost peaks cannot be restored.
Transcoding: Converting a recording from one codec to another. It changes the signal, so it is recorded as a processing step and avoided on evidence copies.

Challenges and limits

What makes it hard

Telephone and messaging audio is narrow-band and heavily compressed, which limits enhancement, authenticity analysis and voice comparison alike
Most recordings reach the examiner as forwards or re-recordings, several generations from the original, and each generation removes evidence
Noise cannot be removed without touching the speech, so enhancement is a trade-off and the report must say what was done
Speaker comparison is affected by recording conditions, duration, emotion, health, disguise and language, and short or poor samples may not support any conclusion
Voice cloning tools can now produce speech that passes casual listening, so the question of whether a voice is synthetic sits alongside whose voice it is
Hum-based dating needs a reference record of the mains frequency for the time and grid in question, which is not available everywhere
Transcription is prone to expectation bias, where a listener hears what they have been told to expect, so transcripts are checked by a second person who has not been told

Keeping the evidence intact

Receive the recording from the device or a forensic extraction, record the route it took and hash it at once
Keep the compressed original untouched and make an uncompressed working copy for all processing
Record every filter, setting and order of application so the enhanced version can be reproduced
Present enhanced audio only alongside the original and labelled as processed
Keep transcripts separate from opinions on authenticity or speaker identity

Standards and legal considerations

SWGDE Best Practices for Forensic Audio
SWGDE's audio documents, including Best Practices for Forensic Audio, Best Practices for Enhancement of Digital Audio and Technical Notes on FFmpeg for Forensic Audio Examination, describe the examination types, the handling of recordings and the use of open tools.
Read the guide
ENFSI Best Practice Manual for Digital Audio Authenticity Analysis
The ENFSI manual on testing whether a digital recording is authentic, alongside its Best Practice Manual for the Methodology of Speaker Comparison, which sets out how voice comparison evidence should be produced and expressed.
ISO/IEC 27042:2015
Guidelines for the analysis and interpretation of digital evidence. For audio, the line between what was heard and what the examiner concludes from it is exactly this standard's concern.
Read the guide
Bharatiya Sakshya Adhiniyam, 2023
India's evidence law treats a recording as an electronic record. The certificate it requires for such records depends on the recording's origin being documented, which is why the generation of the file matters in the report.
Read the guide

In practice

A Threatening Call
A complainant used a call recording app during a threatening call. The examiner obtains the file from the phone through a forensic extraction, finds it is an AMR recording at 8 kHz, reduces traffic noise with gentle filtering and produces a transcript with three words marked as uncertain. The report explains that the caller's voice cannot be compared reliably at this bandwidth without a good reference sample.
A Meeting Recording With a Gap
A party produces a recording said to be a complete meeting. The spectrogram shows the background hum jump in frequency at one point and the room reverberation change at the same moment. The examiner reports that the recording is consistent with two separate recordings joined, and that the content on either side of the join cannot be assumed continuous.
A Voice Note Compared With a Reference
A voice note is attributed to a particular person. Reference recordings exist but were made in a quiet office, while the voice note is an outdoor Opus recording. The examiner reports limited support for the same speaker and explains that the mismatch in conditions keeps the result weak.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

VideoSurveillance & Image / Video ForensicsImage & Video MetadataRead EXIF, XMP, GPS tags and MP4 atoms with ExifTool and know what each field can proveBeginner

VideoSurveillance & Image / Video ForensicsDeepfake / AI ForensicsExamine face swaps and AI-made media, check C2PA provenance and know where detectors failAdvanced

LegalFoundation & Legal CoursesForensic Report WritingWrite clear forensic reports that answer the questions asked and survive cross-examination.IntermediateDCFA

LegalFoundation & Legal CoursesLegal & Court ProceduresIndian law on electronic evidence: BSA Section 63, BNSS search and seizure and the IT Act.BeginnerDCFA

Standards for this area

SWGDE Best PracticesSWGDE publishes the free, practical documents that most digital forensic procedures are quietly built on. This page explains how the library is organised, which documents matter for each kind of work and how they relate to the OSAC Registry.Best practice

Careers that use it

Video Forensic Analyst

Questions people ask

Can you tell whether a recording has been edited?

Often, if the recording is an early generation and the edit left traces in the signal or the file structure. A clean copy with no indications is reported as showing no signs of editing, which is not the same as proof that none occurred.

Can a voice be identified from a recording?

A voice can be compared with reference recordings, and the result is expressed as how strongly the evidence supports the same speaker. Voices change with health, emotion and the phone line, so the discipline does not offer certain identification.

Can all the noise be removed?

No. Noise and speech overlap in frequency and time. Filtering reduces noise at some cost to the speech, and pushing further creates artefacts. The aim is intelligibility, not a clean studio recording.

Is a forwarded voice note good enough?

It can be examined, but it has been re-encoded at least once and its metadata relates to the forward, not the original. Ask for the file from the phone that made it, with the app's database record.