Chapter 19. Discovery of Audio Evidence

Information in this chapter:

• Common issues with audio evidence
• Example discovery language for audio evidence
In order to have the best results possible in any enhancement or forensics work performed against an audio recording; it needs to be treated with care during the processes of collection, preservation, and copying. Also, simply getting a copy of the recording without specifying the output format and copy process may not be the best option, as there are numerous factors with audio recordings that can cause deterioration in the audio quality.
Keywords
Audio Evidence, Recording Devices, Audio Metadata, Audio Collection

Introduction

In order to have the best results possible in any enhancement or forensics work performed against an audio recording, it needs to be treated with care during the processes of collection, preservation, and copying. Also, simply getting a copy of the recording without specifying the output format and copy process may not be the best option, as there are numerous factors with audio recordings that can cause deterioration in the audio quality.
While the forensic processes performed to analyze video and audio evidence may be significantly different, the actual evidence types themselves are similar when it comes to preservation. They both are subject to distortion and data loss if the copying method is not carefully considered in light of reducing the amount of actual data loss that can occur during the copy process.

19.1. Common issues with audio evidence

A sound is a vibration at a set frequency. For instance, a dog whistle is a sound that vibrates at such a high frequency that only animals can hear it. A subwoofer is a bass speaker that actually can produce sounds that the human ear cannot hear, but the human body can “feel” the vibrations in the air. Depending on the recording device, the ability to record and play back sound at these extreme frequencies varies depending on the type of recording media.
Audio recording occurs in two formats, analog and digital. While music purists may maintain that analog recordings have the most natural sound, digital recordings support a wider range of frequencies during the recording and playback process. This means that a digital recording can record more sound in the form of overall frequency range. A sound that is not recordable in analog format due to a very high or very low frequency could appear in a digital format.

19.1.1. Audio recording devices

Audio recording devices range from tape-based recorders such as micro, mini, and standard audio cassettes and reel-to-reel tape recorders, to digital audio recorders that record on compact discs, hard drives, and media cards.
For this reason, if the original is in a digital format, any copies need to be made in a comparable digital format that uses lossless compression. Preferably, the recording method used to duplicate the original would have no compression at all.
On many digital audio recorders, deleted files can be recovered because the media is treated like a computer hard drive, as long as the files have not been overwritten. Your expert will need physical access to the device in order to recover any deleted audio data, if it still exists. Overwritten analog audio tapes cannot be recovered.
It is becoming increasingly popular to recover deleted audio recording from smart phones. If you are able to get access to the physical storage on the phone, such as a media storage card, then recovery of audio files is very possible.

19.1.2. Tape media

If the audio evidence is on an audio tape, such as a cassette tape, any playback of the audio recording will cause the tape to deteriorate. You can think of a cassette tape as a miniature VHS tape. They both deteriorate whenever they are played, rewound, fast-forwarded, or paused. The original audio tape should never be worked from, just as the original hard drive in a computer forensics case should never be used for analysis. A duplicate recording should be made on another cassette tape, or in the best circumstance, a digital copy should be created.
Another issue with magnetic tape is that the tape itself is made from plastic coated with a metal oxide and the plastic does stretch a tiny amount each time the tape is played. This stretching that occurs as a result of repeated playing of a cassette or other audio tape will result in distortion of the recording over time and can cause the pitch of the audio to change.

19.1.3. Audio metadata

If only the audio recording itself is received in discovery, critical information can be missed that might reside on the audio recording device itself, such as the time and date the device was set to when the recording was made.
If the audio is being collected from a smart phone, the date and time information may be available as part of the file system metadata on the phone. This is also true of most digital devices that have a time stamp feature, including digital answering machines, and digital pocket recorders.
The Apple iPhone stores voice mails on the phone and the voice mails can be obtained, including the time stamps, by performing a backup of the phone and then analyzing the backup data itself.

19.1.4. File formats and audio programs

If possible, you want the audio recordings produced in discovery exactly as they were originally collected. Just as with digital video recordings, digital audio recordings can lose quality through file conversions. If this is not an option, you want the audio recordings in a format that is easily accessible using normal audio playback software programs, such as Windows Media Player or iTunes. You do not want the audio recordings to be dependent upon a single piece of audio playback software. A common scenario is that the audio is produced, but is dependent upon a single software program to be played at all, and sometimes these software programs will not allow for rewind, fast-forward, and pause functions. This occurs when a law enforcement agency produces the audio in an encrypted format that cannot be converted into a standard format and must be played using the supplied player only. This forces you to listen to the entire audio recording even when only a small section may be of interest.

19.2. Example discovery language for audio evidence

The following list includes the technical items you want to include in a discovery motion for audio evidence.
1. A copy of any audio evidence already collected or acquired from any device.
2. Access to any device currently in custody for the purpose of making a forensic copy of the device data.
3. Any and all standard operating procedures (SOP) used by (Agency or Expert) regarding audio evidence, to include but not limited to,
a. The acquisition of audio evidence
b. The preservation of audio evidence
c. The storage of audio evidence
d. The analysis and processing of audio evidence
e. The production of audio evidence
4. A resume or curriculum vitae containing the qualifications and experience of any persons involved in the acquisition, preservation, storage, analysis, processing, or production of audio evidence.
5. A listing of all the tools used in the acquisition, preservation, analysis, and processing of audio evidence, to include both hardware and software tools. With software tools, the version of the software should be included. The tools should be listed as used in the examination of audio evidence in sequential order.
6. Any and all chain of custody records regarding the audio evidence.
7. Any and all reports and documentation concerning the methods used to preserve the audio evidence, to include but not limited to, reports and documentation pertaining to hardware or software forensic write-blocking, and reports or documentation pertaining to the hardware or software tools used to create any duplicates of the original evidence and the method of storage for the original audio evidence.
8. A copy of any forensic reports that detail the work process used by the forensic examiner in the course of his or her examination for the audio evidence in this case, including any logs created by the analysis software used to examine the evidence.

Summary

In this chapter we looked at some of the issues surrounding the discovery of audio evidence. We also discussed the different issues with audio media, such as magnetic tape. This chapter also covered why audio formats are important from a discovery standpoint and some of the various devices that can record audio. Audio metadata was also discussed, specifically the lack of metadata in analog recordings versus the presence of metadata in many types of digital recording devices.
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset