Problems of Forensic Sciences 2016, vol. 105, 355–369 TEST AUDIO RECORDINGS AND THEIR USE IN AUTHENTICITY EXAMINATIONS. DATABASE OF PROPERTIES OF DIGITAL AUDIO RECORDERS AND RECORDINGS Marcin Michałek Institute of Forensic Research, Kraków, Poland Summary currently, there are many brands and models of devices with a digital audio recording function and with different recording pa- rameters. at present, experts almost exclusively receive digital devices and recordings stored using digital technology for foren- sic audio examination – these have almost entirely replaced analogue techniques in the field of multimedia. The aim of this study was to collect devices with a digital audio recording function, and then make test recordings with these devices and determine the possibility of converting them into a standard format. a database containing the parameters of the analysed recorders and their recordings was created as part of this study. The test recordings were made in available recording formats for each recorder and under different acoustic conditions. it was determined that the largest groups of analysed recorders was voice recorders (75%), followed by mobile phones (19%) and other devices with an audio recording function, such as multimedia players, tab- lets and cameras (6% in total). The test recordings were made in 18 different recording formats, which were characterized by different quality and parameters. The most numerous formats were: WaVe aDPcM, WMa and MP3. The conducted research and results, as well as the constructed database, are helpful for experts investigating the authenticity of audio recordings. Key words authentic recording; Database; Digital recorder; Test recording. Received 20 June 2016; accepted 29 September 2016 1. Introduction digital recordings. Now, thanks to the prevalence of digital devices, expert reports concerning analysis of The technique of digital recording and editing analogue recordings are rare. expert practice indicates of data has been applied in particular to multimedia that evidentiary digital recordings are mostly made not documents (ho, Li, 2015; Savage, Vogel, 2014). cur- with high quality professional equipment, but rather rently, the prevalence and diversity of digital devic- with widely used consumer devices, such as those es with a recording capacity is increasing – not only mentioned above (Michałek, 2014). voice recorders and video cameras dedicated to this Due to the large number of brands and models of purpose, but also other generally used devices, such recorders, there are currently many audio recording as mobile phones, tablets, cameras, multimedia play- formats, which are distinguished by various parame- ers and various types of flash drives (memory sticks) ters (casey, Turnbull, 2011; ho, Li, 2015; Urbański, with a recording function (ho, Li, 2015; Michałek, 1989). in forensic audio analysis, the best solution is 2014). Just a few years ago, evidentiary analogue to import a recording into the working space of pro- recordings constituted the clear majority among ev- fessional programmes designed for listening to and identiary recordings, with just a small proportion of analysing recordings. Such programmes usually rec- 356 M. Michałek ognise many common recording formats. However, database constitutes a tool that can aid experts in the some producers, even well-known, use their own, of- authentication of digital audio recordings. ten non-standard, recording formats in their own re- corders, which require conversion to standard format for the purpose of importing them into analysing soft- 2. The significance and making of test ware. Therefore, it is important to have a programme recordings which will make such a conversion, for example into the form of uncompressed WaVe PcM. When carrying out an authentication of a record- The fact of acceptance of recordings as evidence ing, special attention should be paid to the stage linked material by a judicial body and also the range of re- with making test recordings. Could an evidential re- quested analyses results in the necessity of evaluat- cording have been tampered with? is it original? Was ing their authenticity (cooper, 2006; Grigoras, 2005; it recorded using a particular recorder? – these are hong, Yin, 2013; kajstura, Trawińska, hebenstreit, among the most frequent questions posed by judicial 2005; koenig, 1990; korycki, 2011; Michałek, 2009). bodies and related to forensic audio analysis. In order The definition of the authenticity of a recording given to answer them, it is necessary to carry out an analysis by the audio engineering Society (aeS) indicates the of the recording’s authenticity. necessity of establishing its continuity and originali- The evidential material collected in the case may ty and hence the method of recording (aeS, 1996). include – apart from the recording – the recorder The prevalence of equipment and software used for which is believed to have been used to make the re- digital editing of recordings has created broad possi- cording. if the judicial body has not provided the giv- bilities of interfering in their content (kirn, 2007; ko- en recording device, the expert should request that it rbecki, 1999; Sztekmiler, 2003). That is why currently be secured and submitted to him/her for examination. authentications of digital recordings require a combi- The recorder can be used to make test recordings and nation of various forensic audio methods, as well as carry out a comparative auditory analysis as well as the co-participation of tools from the field of forensic an analysis of the parameters and characteristics – and informatics. also of possible traces indicating discontinuity – in an important element in the process of authenti- relation to the evidential recording. In this way it is cating a digital recording is making test recordings possible to establish methods of copying recordings with the help of the device that is believed to have from and to the memory of the device in question. This been used to make the digital recording. These test re- stage of testing also allows you to establish whether cordings allow you to carry out a comparative analysis the analysed device is working properly and can re- of their parameters and file structure in relation to the cord. Before the expert starts to study the recorder and evidentiary recording. They also enable you to verify make test recordings, its current settings must be ver- whether the recorder is working correctly, to study its ified – including the date and time – and data must properties and to establish whether it could really have be secured from the memory by making copies of its been used to make the evidentiary recording (cooper, contents. This enables a comparison of the content of 2006; hong, Yin, 2013; koenig, Lacey, 2012). the memory of the recorder after finishing the analysis Digital recorders that are currently generally avail- with the state before beginning analysis. If the device able enable you to choose recording parameters, result- allows it the expert should make a so-called memo- ing in recordings of varying quality. The wide variety ry image as well as calculate checksums, for example of brands and models of these devices and of the for- with an MD5 algorithm, both for the physical area of mats of recordings has compelled us to undertake re- the imaged memory of the device, and – for the pur- search in this field. in this paper, the process of making pose of verification – for its image. This is aimed at test audio recordings and analysing their parameters securing the memory of the data carrier in the state in has been described. The test recordings were made us- which it was submitted for analysis, which has great ing the collected recording devices, making use of the significance for results and conclusions drawn on this range of available settings and recording functions. On basis (Breeuwsma, De Jongh, klaver, Van Der knijff, this basis, a database has been constructed containing Roeloffs, 2007; casey, 2010). information about the studied recording devices and Before making test recordings, it is necessary to the recorded test recordings, together with access to carry out a thorough auditory analysis as well as an original audio files. The database also contains a list analysis of parameters and characteristics of the evi- of programmes enabling conversion of recordings to dential recording for the purpose of establishing what the standard format – WaVe PcM. The constructed sounds were recorded and in what acoustic conditions. Problems of Forensic Sciences 2016, vol. 105, 355–369 Test audio recordings and their use in authenticity examinations. Database of properties of digital audio recorders and... 357 The expert should also familiarize with the recording ta, which describe relevant data with encoded sound possibilities, the functions of the recording device (Gloe, Fisher, kirchner, 2014; hong, Yin, 2013; koe- and the power supply options, by analysing the op- nig, Lacey, 2012). Such an analysis is carried out using erating manual and the available menu as well as by software enabling visualisation and editing of files in assessing the technical state. This will enable you to the form of hexadecimal code. draw up a plan for making test recordings, containing Metadata in audio files contain information that is a description of their execution, the sequence of re- significant for authentication investigations. in par- cordings and the sequence of played back sounds as ticular, the format of a recording and