File000135

Module XXII – Audio File Forensics

EC-CouncilCopyright © by EC-Council

All Rights Reserved. Reproduction is Strictly Prohibited

News: UCD to Lead Way in Audio, Video Forensics

Source: http://www.rockymountainnews.com/

By Bill Scanlon,

February 5, 2008 at 4:45 p.m.

Denver may become a mecca for police nationwide who need to solve crimes by carefully analyzing audio and video evidence.

A professor at the University of Colorado at Denver has won $710,000 in Federal Earmark Grants to establish a new National Center for Audio/Video Forensics.

Housed in UCD's Department of Music and Entertainment Industry Studies, the center would establish a "cutting-edge forensics center" to spur new knowledge and methods in the field of audio and video forensics, Professor Richard Sanders said.

Undergraduates, graduates and professionals could learn the latest techniques in, say, tracking phone use by prisoners, or discovering when someone is impersonating another's voice to move cash out of a bank account.

Voice biometrics would work in combination with fingerprints, DNA and facial recognition to identify suspects.

The grant will give real-world research opportunities to students in recording arts, statistics, computer science and the health sciences programs, Sanders said.

It also will give local police, attorneys, investigators and homeland security officers access to state-of-the-art forensics technology, he said.

Sanders' work in audio forensics was tapped by investigators working the JonBenet Ramsey case, the Kobe Bryant case, the Columbine High School shootings and the Oklahoma City bombing trial.

The grants were awarded by the U.S. Department of Justice. Additional support came from the university, the international Audio Engineering Society, the American College of Forensic Examiners, the American Board of Recorded Evidence and the National Law Enforcement Technology Center.



News: Audio Forensics Experts Reveal (Some) Secrets

Source: http://www.wired.com/



Module Objective

• Audio Forensics• Why Audio Forensics?• Fast Fourier Transform (FFT)• Methodologies• Audio Forensic Process• Sound Recordings as Evidence in Court Proceedings• Tools

This module will familiarize you with:



Module Flow

Audio Forensics

Methodologies Fast Fourier Transform

Tools

Sound Recordings as Evidence in Court Proceedings

Audio Forensic Process

Why Audio Forensics?



Audio Forensics

Audio Forensics is the appellation for the engineering discipline involving the analysis, evaluation, and presentation of acoustic evidence in a judicial inquiry normally leading towards a presentation in court

The application of audio science and technology aids to investigate and establish facts in criminal or civil courts of law



Why Audio Forensics?

Audio Tape Verification and Authentication

Monitoring suspicious criminal targets

Audio Tape Enhancement

Voiceprint Analysis

Tracking missed information

Monitoring employees



Use of Voice as a Tool

Investigators use audio for solving the case which needs listenability and intelligibility of the audio

Scenario: Person X gave a call to police and informed about a murder. Cops rushed to the place where the incident took place but there they could not find any clue. The only thing they had was a call recorded. Now the recorded voice is analyzed to resolve the case.



Fast Fourier Transform (FFT)

Fast fourier transform is an algorithm used to analyze the authenticity of the audio

It breaks the audio signal into time-frequency spectrum

It checks for discontinuities in the audio spectrum

• Audio signal: The normal spectrum in time-frequency form• FFT analysis graph: The graph that shows details of discontinuities in the

audio signal spectrum

It generates two graphs:



FFT Analysis: Screenshot 1




Discontinuities on A’s background

B’s Background






Methodologies of Audio Forensics

Voice identification

Audibility analysis

Audio enhancement

Authenticity analysis

Sound identification

Event sequence analysis

Dialogue decoding

Remnant signal analysis



Voice Identification

Voice identification is comparison of known suspicious voice to the recorded voice

It compares elements of voice such as bandwidth, fundamental frequency, resonance, pitch striations, vowel formal trajectory, prosody, pattern of breath, and special speech style of the speaker

Voice phonetics of each individual differs from the other

Phonetic components of the recorded voice are analyzed and compared with the suspect to identify the voice

Digital or analog spectrograph is used for voice identification



Voice Identification (cont’d)

• Check whether the recording consists of sufficient amount of voice for analyzing

• Look at the quality of the voice• Check if the conversation volume is high when compared to the

background noise

Pre-identification considerations:

Check



Audibility Analysis

Audibility Analysis is the reconstruction of an

acoustic event to determine whether the event is

audible for a person of average hearing ability

It checks whether the audio signal is audible or

obscured by the noise or masking signals

Make use of the aural/spectrograph,

acoustical measurements, and acoustical simulation to analyze the audibility of speech, siren, alarm, etc. at a particular place or time



Audio Enhancement

Audio enhancement is the technique of improving the quality of the audio in terms of listenability and intelligibility

Listenability enhancement involves applying equalization, compression, amplitude increment, and limiting techniques to make an audio signal intelligible

Intelligibility enhancement is breaking the audio in small sections, processing them independently, and thus assembling them

• Spectrographic analysis• Complex de-convolution filtering• Wideband and multiband compression• Amplitude increase and limiting

Intelligibility enhancement procedure involves:



Audio Enhancement (cont’d)

• Clicks caused due to the discontinuity in recording• Hiss caused due to the cassette tape• Engine noise caused due to car cameras• Background noise recorded while recording a call• Hum, buzz, and pop noises caused due to power sources• Ruffling sounds caused while recording the audio through hidden

recorders

The type of noises that are removed or minimized through enhancement technique:

The sound that makes desired audio unintelligible is termed as noise



Audio Enhancement: Screenshots



Authenticity Analysis

Authenticity analysis determines whether the audio origin is same as what the acoustic event is representing

• Aural analysis• Magnetic tape development• Physical inspection• Frequency• Manufactured date• Amplitude and formant analysis

It involves suspicious recording to verify the authenticity by means of:



Sound Identification

Sound identification involves comparison of sound under investigation to a known sound

It is critical in determining whether a barely audible sound is a voice or an acoustic illusion caused by the recording device or an extraneous sound source

Sound identification techniques generally require original recording device for comparison of sound

Use spectrograph for the comparison of sound



Event Sequence Analysis

Event sequence analysis is the analysis of the sequence of acoustic events in the recording that determines components such as time, frequency, and amplitude

It verifies authenticity of the recording

It reveals absolute duplication of events



Dialogue Decoding

Dialogue decoding is the extraction of the message from the recording

It is based upon voice patterns in a spectrograph



Remnant Signal Analysis

Remnant signal analysis is analyzing the segment of audio that seems to be irrelevant for investigation

The segment of audio/recording can be the disturbance caused due to the surroundings, machine rhythms, reverberation, etc.



Integrity Verification of the Audio

Integrity verification of the audio is necessary to qualify or disqualify the tape for further proceedings

Tape editing technology is editing the audio recording for gaining audibility

Electronic tape editing can be noticed with acoustic irregularities in the audio through devices that can detect editing

Few alterations to digitized recording are difficult to be traced, if they are copied on other tape



Integrity Verification of the Audio (cont’d)

• Total loss of the audio signal• Change in the speaker’s frequency response during

different telephone conversations• Spikes that provide audible sounds of short duration

(attributable to normal stop, start, and pause functions of the recorder)

• Traditional tape technique involves suspecting the modifications made by checking and noting:• Unexplained transients• Equipment sounds• Extraneous voices• Inconsistencies with provided written information

Suspicious acoustic events:



Audio Forensics Process

Spectrographic analysis

Preparation of spectrograms

Conversion of analog audio to digital audio

Preliminary examination

Preparation of copies

Preparation of exemplars

Evidence handling



Audio Forensics Process: Evidence Handling

Gather all the tapes that are recorded and considered as evidence

It is essential to identify, maintain physical integrity, and to ensure the audio as evidence for forensic purpose

Critically listen to the original tape

Do physical inspection of the tape

Check if the tape is tampered

Document all the actions that are taken to protect the evidence



Audio Forensics Process: Preparation of Exemplars

It involves comparison of original spectrum to unknown voice samples

Here, suspect’s voice is recorded, where dialogue in the original recording is repeated

Exemplars are prepared by investigators

Check the performance of the recorder used for original recording

Conditions of recording and speech delivery must be duplicated for easy analysis

Analyze the exemplar to compare voice in audio file with the voice of the suspicious person

It offers voice identification



Audio Forensics Process: Preparation of Copies

Preserve original recording for court proceedings

Create copies of recording so that the original tape is not corrupted

For voice identification, look for direct copies of the recording

It enhances the original recording thus removing noise for better audibility

Playback of evidential audio depends upon track determination, azimuth alignment, speed accuracy, and reproducer of the recording



Audio Forensics Process: Preliminary Examination

Check the audio files that are to be examined

Determine the integrity and authenticity of the audio

Check whether the recording is original or modified

Determine if the known and unknown voice samples meet guidelines to allow further examination

Analyze the quality of voice samples by suppressing the noise or distortion



Audio Forensics Process: Analog to Digital Conversion

• Use A-to-D converters such as Successive approximation ADC, Flash ADC, Dual Slope ADC, etc.

Convert analog audio to digital audio

• Use the tools such as Zune music recovery Software for recovering/extracting the corrupted audio

Extract the audio, if it is digital and corrupted

• Avoid mismatch of the extension/format of the audio file

Check for compatibility of audio file



Audio File Formats http://www.fileinfo.net/



Audio File Formats (cont’d)



























Audio Forensics Process: Preparation of Spectrograms

Use sound spectrograph for preparation of spectrograms

Investigator identifies the speech by formatting and marking the spectrogram

Retention of spectrogram is necessary until the completion of the investigation



Audio Forensics Process: Spectrographic Analysis

It involves pattern and aural comparison of the voice sample

Perform spectrum and waveform analysis of the audio signals

Pattern comparison is the comparison of original and enhanced sample, similar speech sound, and number of comparable words depending upon the pitch and energy distribution



Sound Spectrograph

Spectrograph is the device used for visualizing the graph or spectrum of the audio

Spectrum enables the investigators to detect the addition or enhancement made to the audio

Disguised voice cannot direct the spectrograph in a wrong way

The spectrum of the audio signal is displayed in frequency and amplitude form

Time is on x-axis, with frequency on y-axis and voice energy in the form of gray scale (spectrum)

Audio signal spectrum



Sound Recordings As Evidence In Court Proceedings

• Testimony by defense, plaintiff, or government witnesses of tampering or other illegal acts

• Problem description should be complete which includes exact location of recording, type of alteration, scientific test performed, etc.

• The original tape must be provided as duplicate tape cannot be authenticated and are not accepted for examination

• Tape recorders and related components used to produce the recording must be provided

• Written records of any damage or maintenance done to the recorders, accessories, and other submitted equipment

Audio evidence in courts should be accompanied with:

Witness



Audio File Manipulation

• Deletion• Deleting the unwanted portion of the audio by splicing or using a recorder

• Obscuration• Involving distortion to the recording thus leaving the audio unintelligible• It is used for masking the audio

• Transformation• Altering the portions of audio for changing the meaning of the conversation

• Synthesis• Generation of additional text such as background sound or conversation to original

recording is termed as synthesis

Alterations or tampering in a recording can be through:

These can be suspected with gaps, fades, transients, and equipment sounds of the altered recording



Tools



DCLive Forensics

• DSS filter• It recovers speech from recordings that contain loud music or

other coherent noise

• Adaptive filter• It is used in audio applications where the ambient noise

environment is constantly changing

• AFDF Forensics Filter• It automatically adjusts itself to varying noise environments with

no noise sample being taken

It consists of:

DCLive Forensics tool analyzes, enhances, and improves difficult recordings using a system with a sound card



DCLive Forensics (cont’d)

• It allows the mathematicians, scientists, and engineers to create their own transfer function using a polynomial expression

Polynomial Filter

• In forensic audio applications, it is used for removing in-band and out-of-band extraneous noises

Spectral Filter

• It provides a method for displaying audio as a waveform in time, frequency, and intensity form on the graph

Spectrogram

• It is used to repair signals, which were either clipped by digital or analog mechanisms

DeClipper




• It is designed to be used in real time intelligence gathering and Forensics surveillance situations

• It allows to go back and listen to something that you may have heard during real time operation of the software

Flashback Recording

• It automatically logs an unedited raw version of the recording along with the enhanced version with a backup

Dual Stream Recording

• It allows the recorder to start and stop itself based on the presence or lack of presence of an audio input signal

VOX Record Activation




• Each recording event will be marked with the exact time and date of the individual recording

Auto Date and Time Stamp

• It automatically starts a new file every time the 2 gig limit is reached and never misses a beat

Unlimited Recording Time

• These are FIR (Finite Impulse Response) filters that exhibit a high degree of out-of-band attenuation

Brick Wall Filter



Features of DCLive Forensics

Higher resolution spectral filter offering a 32,000 band EQ

Improved time domain adaptive filter

All popular formats of audio are supported

Tune library organizes the investigator’s collection

Impulse filter enhancements



Zoom H2 Portable Digital Recorder

• It has built-in USB 2.0 interface• It has On-board chromatic guitar/bass tuner• Time stamp and track marker functions in Broadcast WAV

Format (BWF)• It has 512MB SD memory card• Accommodates up to 4GB SD memory cards• Auto Gain Control (AGC) for pristine recordings• Low-cut filter eliminates wind noise

Features:

Zoom H2 portable digital recorder provides brilliant stereo recording in an ultra-portable device



CEDAR for Windows

CEDAR for Windows is a radical departure in audio restoration systems

It offers both multi-channel and simultaneous multiple-process restoration capabilities

It can be used in applications of Windows such as audio preparation for DVD and surround formats as well as for stereo mastering



CEDAR for Windows (cont’d)

Declick is an invaluable process that removes scratches and clicks encountered in audio files

Console is the tool for audio restoration process that controls up to 16 channels




Dehiss2 includes an algorithm that offers broadband noise reduction with neither spectral analysis nor offline processing

Decrackle is the effective process of removing crackle, buzz, surface noise, and distortion from the audio




Phase corrector improves mono compatibility and stereo imaging, extends high frequencies, and tightens bass response of the audio signal

NR-3 v2 is a powerful and flexible noise reduction system for speech and music developed for the audio and video industries




EQ and dynamics provide dynamic processing and equalization with multiple processes per channel

Spectral Analyzer analyzes the spectrum of the audio signal



Audio File Forensic Tools: DCVST & Advanced Audio Corrector

Advanced Audio Corrector removes phase distortions in high-quality audio files before coding it to MP3 format

DCVST is a plug in based on the (AFDF) Automatic Forensic Adaptive Filter that is found in the Continuous Noise Filter DC LIVE/Forensics



Audio File Forensic Tools: Acoustica & Smaart

Acoustica is an ideal solution for audio editing and mastering which records, edits and processes audio on the system

Smaart is a software designed for real-time sound system measurement, optimization and control software for Microsoft Windows and Mac operating system



Audio File Forensic Tools: DNS1500 & DNS2000

DNS1500 Dialogue noise suppression suppresses noise content from recordings or live surveillance and curbs excessive reverberation

DNS2000 Dialogue noise suppressor removes background noise from recordings and live transmissions



Audio File Forensic Tools: DNS 3000

DNS 3000 is an automated dialogue noise suppression with scenes, memories, moving faders, and pro-tools integration

• On-board scenes with a simple and intuitive recall system

• Automation to LTC time code• Moving faders and sample rates up to 96kHz • Ensures that there is no loss of lip-sync• Eliminates all manner of noises from recordings and

live transmissions

Features



Audio File Forensic Tools: M-Audio MicroTrack 2496 & CARDINAL

M-Audio MicroTrack 2496 is a rugged high-fidelity mobile 2-channel digital recorder that records WAV and MP3 files to CompactFlash or microdrives

CARDINAL is the next generation forensic audio processor



Audio File Forensic Tools: JBR 4 Channel Microcassette Playback/Transcriber Unit& JBR Universal DVD/CD Player/Transcriber

• It is designed to safely and accurately play all known ¼ track stereo and ½-track monaural micro-cassette recordings

JBR 4 Channel Microcassette Playback/Transcriber Unit

• It is designed and optimized for playing and transcribing all CDs and DVDs• It enhances the efficiency and accuracy of the transcriber

JBR Universal DVD/CD Player/Transcriber



Summary

Audio Forensics is the appellation for the engineering discipline involving the analysis, evaluation, and presentation of acoustic evidence in a judicial inquiry normally leading towards a presentation in court

Voice comparison standards involve evidence handling, preparation of exemplars, copies, and spectrograms, preliminary examination, and spectrographic analysis

Integrity verification of the audio is necessary to qualify or disqualify the tape for further proceedings

Sound recordings are presented as evidence in court proceedings

Audio forensics involves various methodologies that are enhanced for gaining audibility and intelligibility of the audio

DCLive Forensics is the audio forensics tool that analyzes, enhances, and improves difficult recordings using a system with a sound card



