Audio forensics

The field this sits inside, and the one that answers most of the questions people bring to a detector. It was here long before speech synthesis and it decides more disputes.

What an examination actually looks at

Very little of it is listening. The work is mostly about the file and its history, and the questions come in a rough order.

• Is this the original? A file exported from a chat thread is not the recording; it is a re-encoded copy of one, usually stripped of the metadata that would have answered the next four questions.
• What has the container been through? Encoder used, sample rate, number of compression passes, whether the structure is consistent with the device and app it is said to come from.
• Where are the joins? Edits leave boundaries. Background noise, room reverberation and the noise floor of a microphone are continuous in a real recording and rarely continuous across a splice.
• Does the environment behave? A real room has a settling character; a real speaker moves relative to the microphone. Both are difficult to fabricate and easy to check.
• Who has held it, in order? The unglamorous one, and often decisive. A recording nobody can account for between creation and disclosure is weak however it sounds.

Where a recording happened to capture the hum of mains electricity, its slow fluctuation can sometimes be compared against a reference record of the local grid, in jurisdictions where such records are kept and obtainable. That is characteristic of the field: an answer built from a physical trace nobody was thinking about at the time.

Detection answers one question out of many

A synthesis detector addresses a single narrow item on that list — was any of this generated. It is a genuinely new question, and it does not touch the others. A clip can be entirely non-synthetic and still be an edited, undated, unsourced copy that proves nothing.

This is the misunderstanding to watch for when a detector output reaches a dispute. “It came back likely human, so it is real” skips every question above. Our page on recordings produced in disputes puts them in the order a lawyer would.

A concrete case

An employee is dismissed after a recording surfaces of him threatening a colleague. He says he never said it. The clip is a forwarded audio file in a group chat, forty seconds long.

What decides this is rarely the waveform. It is whether the original exists on a device, what the phone’s own storage record shows, whether the forty seconds is the whole recording or an excerpt from something longer, and whether anything else — a calendar entry, a witness, a message sent minutes later — supports a conversation having happened at all. A synthesis result is one line in that examination, and if the file has been through two rounds of chat compression it may be a line that reads unclear.

Commonly confused with: audio provenance, and with enhancement

Provenance is the forward-looking version of the same concern: recording where a file came from at the moment it is created, so that history does not have to be reconstructed later. Forensics is what you are left with when nothing was recorded at the time, which is almost always.

Enhancement is the other neighbour, and it is the one that causes damage. Cleaning up a recording — noise reduction, normalising, converting to a convenient format — destroys precisely the traces an examination depends on, including the ones a synthesis detector needs. Work on a copy, always, and leave the original untouched on the device that made it.

What a Truthring report is, in forensic terms

It is an instrument reading, produced by a stated version of a stated method, on a file identified by a one-way hash. It is not an expert opinion and does not pretend to be one. The engine version and date sit on the report so that it can be checked later against the method changelog, which is the minimum a reading has to carry to be worth anything after the fact.

An examiner can use that as one input. What they cannot do is substitute it for the rest of the work, and we would rather say so than sell a report as a conclusion. Notes for legal teams set out what the output does and does not support.

Questions this term raises