Expert practice..
Expert practice
Forensic examination of sound recordings.
Experts: Ivanov I.L., Popova A.R.
Characteristic questions of the examination:
1. Was the phonogram presented for examination recorded on a Panasonic…..» voice recorder? (which was also presented for examination)
2. Is the magnetic phonogram presented for examination an original?
3.Are there any signs of editing during or after recording?
As a result of statistical calculations, it was revealed that approximately every second examination contains phonograms with signs of digitization, every seventh — with intentional or unintentional computer editing.
Expert practice over the past four years has shown that the areas of research related to the search for the aliasing effect, signs of signal conversion from digital to analog representation, signs characteristic of digital signal processing algorithms, traces of the operation of ADC filters (i.e. filter cutoffs), research of noise levels before and after the sounding phrase, do not always lead to a statement about the presence or absence of any signs that allow an unambiguous answer to the questions posed. If such signs are found, then on those phonograms that were initially digitized, and in the process of research there is no doubt about this fact and it is necessary to simply look for confirmation of the fact of digitization. Currently, almost all government agencies engaged in authorized wiretapping record conversations on a PC. The sampling frequency of 8 kHz has long been known to experts, but aliasing and other traces of characteristic ADCs were not found on the phonograms (even if it is known for sure that the phonogram was previously digitized). Perhaps the aliasing effect was discovered and studied at the time when the first prototypes of Sound blaster were used on the market, perhaps also 8 bit, with built-in filters that had poor quality characteristics. But the Sound blaster park has advanced so much that the parameters of modern devices for wide use leave virtually no traces of the aliasing effect. Thus, searching for traces of this effect is currently almost impossible. At present, there is only one phonogram with the aliasing feature.
Therefore, other directions for searching for the above phenomena are necessary. This article will reflect only a few methods developed in expert practice.
1. Start-stop moments.
2. Spectral components of the recording channel.
3. Continuity of the phase of a continuous harmonic.
4. Continuous harmonic phase break.
5. Harmonic interference.
6. Private features of the recording device.
By the way, I have never met any “specialists” who glue tapes together to edit a soundtrack and present it to the court as evidence. Maybe someone has met one – please describe it or send it to us – we will laugh together or open a section of jokes.
Start – stop moments
To date, no soundtracks have been received with traces of editing produced using tape dubbing (identification of editing by start-stop moments), since they are practically impossible to hide. There are often cases when several soundtracks can be presented on one magnetic tape, or we see a start-stop in the middle of a continuous soundtrack. Since these features of the soundtrack are displayed on the screen, well visualized, it is advisable to study them, compare and replenish the existing start-stop database. A productive method is the copy and overlay method. For example, let's look at the editor window: Fig. No. 1
Fig 1.
Presented are 10 telephone conversations, initially recorded using a personal computer, then compiled into one file and dumped onto magnetic tape in one pass. (Currently, almost all government agencies involved in authorized wiretapping record conversations on personal computers, and in our region, agencies have already started using digital dictaphones connected to personal computers to dump phonograms).
During the study, there is a complete absence of start-stop moments:
Figure 2.
Another point is the obvious presence of start-stop moments. In this case, when studying start-stop moments, the following research conclusions can be made:
— was a fragment of the phonogram accidentally erased on the same recording device?
— during the recording of the original soundtrack, was the recording device turned off and turned on for recording immediately — or after a long period of time (within a 15-second shutdown period, the asymptotic behavior of the harmonic phase is investigated, and if there is a long pause of more than 10 minutes, the change in the frequency of the continuous harmonic is investigated)?
You can also answer the question,
— what do we have: accidental erasure of a fragment after a continuous recording, or actual editing – deletion (insertion) of a fragment with an estimate of the approximate duration of the deleted fragment (the continuity of the phase at the point of erasure of the fragment is checked)?
Fig 3.
Fig. 3 shows the starting signal from the database (scaled by level (we did not touch the vertical offset) — red and the signal under study — blue). With a similar analysis of the stop signals, the sound recording device was clearly identified visually, along with other features.
In principle, given that we can superimpose several start-stop signals on each other and on the signal under study, visually adjust their position, amplitude, vertical offset, color, scale them by X and Y, measure the duration of transient processes with any accuracy, compare them with the start-stop moment database, we can finish this section of the article devoted to start-stop signals and move on to the next section.
Spectral components of the recording channel
This method is effectively used to solve the following questions:
— Was the phonogram submitted for examination recorded on a Panasonic…..» voice recorder, also submitted for examination?
For this purpose:
A control recording is made on a clean cassette and the spectral components are analyzed:
The study of the recording channel of the device presented for the study — the frequency response, the identification of all harmonics of the recording channel and the removal of start-stop moments — allows you to detect many private identification features. (In expert practice, there was a case when a control recording on a new magnetic tape did not allow you to detect a match between the frequency response and harmonics of the recording channel. The solution was found by recording a control phonogram on the magnetic tape under study, but from the reverse side, free from recording. In this case, the match of all identification features was unambiguously confirmed). Expert practice has shown that there is no recording device that does not leave behind harmonics of the recording channel. Harmonic levels are visualized and identified at any interference levels, among any level of continuous noise. Everything depends on the resolution of the software product used in the study, the quality of the Sound blaster, and properly tested ARM equipment. Typically, from 4 to 12 harmonics of the recording channel are visualized. Naturally, different models of recording devices cannot be adjusted with the same precision (take, for example, the bias frequency, even in the highest quality devices there is a large tolerance for the initial setting, and over time it still floats in frequency, remaining within the permissible limits based on all tolerance standards). Our ability to measure their amplitude and frequency with an accuracy of up to minus the fourth power after the decimal point and at the same time track their change over a period of time (the so-called warming up of the erase generator parts — mainly due to it, combination components appear, which penetrate the recording channel), discharge of batteries or power elements — allows us to collect a good bouquet of identification features of the recording device under study. And if we can also detect detonation of a continuous harmonic within 0.5 — 100 Hz and more and also measure its relative value (i.e. which primary or secondary shaft of the tape transport mechanism rotates with such and such frequency and with such and such relative amplitude), then the conclusions can be made more reasonably.
Recently, a new method of studying the recording device submitted for study has been developed. It is based on removing the «passport» of the recording device channel. It turns out that in identical models, of the same series, of the same delivery, the recording channels are absolutely different. This is due to the spread of tolerances embedded in microcircuits and other semiconductor elements, capacitors, resistors, etc. — i.e. everything that the recording channel of a specific device consists of. It turned out that two identical channels cannot exist in nature. Thus, the recording channel passport of a specific device is removed, and it can even be used to replenish the database (like fingerprints) and then use the passport for identification research.
Continuity of the phase of a continuous harmonic.
Discontinuity of the phase of a continuous harmonic
First, we should answer the question: what is a continuous harmonic? Perhaps, this term is unclear to someone. A bit of theory (though, so far there is not a single source to which I could refer you, this is not described in the literature).
In the previous section, we mentioned that any recording channel leaves its traces in the form of a set of continuous frequencies, sometimes very weak in level, not visually displayed. But this does not mean that our ARM does not see them. It has different eyes. So, we generate a harmonic in a new file, for example, 50 Hz (and in principle, any harmonic up to the Nyquist frequency is possible) — the one that all recording devices want to get rid of, but they do not succeed completely, and so with an amplitude of 200, a length of 20 seconds. The spectrum is shown in the figure. This is a «representative» of a continuous harmonic.
Figure 4.
In red is the phase +44.82 degrees, in green is the amplitude, as we can see, 199.95 counts (remember what we generated). Now we can figure out along the axes where the counts and degrees of the phase and seconds are. Got it? Next, from the third to the fifth second, we cut out a piece and paste it in the tenth second — and what do we see in the picture below — on the left?
Figure 5.6.
At the third second there was a phase break of 59.57 degrees, at the tenth — even more, at the twelfth — less (you should have different results, experiment and do not forget that you have the Undo command). This is how you can edit using a PC: delete something (what is not needed), and then insert it in the right place (what is needed), retouch the noise at the place of deletion and at the place of insertion — and the editing is ready. The same can be done using two recording devices.
And what will the phase look like if we accidentally press the record button while listening to the recording (a common occurrence among operatives when listening and establishing the verbatim content)? In the right figure, the section from the 15th to the 18th second is zeroed (i.e. erased by an accidental press) — but the phase after deletion has not changed — it was 45 rad before deletion, and it remains after it. Thus, it is possible to synthesize the phase even in the absence of a signal (asymptotic behavior).
So, there is a beginning – something was cut (into the buffer from 3 to 5 seconds), then pasted (for 10 seconds from the buffer), a piece was erased (from 15 to 18 seconds) – see the pictures.
Thus, the continuity of the phase is understood. That is, there is an instantaneous measurement of the phase of any continuous harmonic at any point in the signal, as well as its instantaneous frequency and amplitude values. The physics and mathematics are simple: in each sample or sample, two adjacent samples are taken, a smooth envelope is drawn along them, then it is described by a mathematical formula — a smooth curve, a spectrum is taken from the smooth curve, and the frequency and phase of the average value of the curve are calculated, and it coincides with the measured sample). The study is possible not only on an ideal signal, but also on a noisy signal. We carry out te the same actions, but we noise the signal with strong white noise so that the harmonic being studied is visually indistinguishable — or to such a level that we lose sight of it (generate a white noise signal with an amplitude of approximately 10,000 thousand samples, i.e. start simpler, and mix, i.e. copy it and superimpose it on the previously created one). In the lower figure, the effect of noise on the harmonic phase is clearly visible, but its phase is perfectly visualized. Also, the signal was cut from the 3rd to the 5th second and inserted at the 10th second and zeroed (erased) around the 15th second. All places of editing and erasing are visualized quite accurately (remember physics: minus 180 degrees are equal to plus 180 degrees, so the phase turn from top to bottom is visible, but it can be manually shifted up or down). The issues of quantitative measurement of the phase, amplitude, frequency of the harmonic being studied remain quite accurate (i.e. three or four decimal places are correct). (For more accurate measurements, select an area for averaging)
Fig. 7.
Let's analyze this type of soundtrack research not only in theory, as was done above, but also in practice. To begin with, let's consider, for example, the frequency of our electric network, i.e. let's turn it on for a few minutes to record, let's not send a signal, and let's investigate: what's going on with our 50Hz interference or a multiple of it. We'll see the following figure.
Figure 8.
As we can see, the network frequency is constantly «wandering». In two minutes, the phase has changed by more than 720 degrees, and the frequency, which was 49.99048 Hz at the beginning, increased to 50.02605 at the end, i.e. by more than 0.03 Hz (brown color of the graph). From these observations, we can draw the following conclusions (summing up the observations for an hour of research) (in the Demo subdirectory on the laser disk there is an archived file of a 2-hour recording)
1. The phase (and therefore the frequency) is unstable, changing by 360 degrees in about a minute.
2. The network frequency changes by at least 0.01Hz in a minute.
3. Long-term monitoring (for 1 hour) allows tracking changes in the power supply frequency up to 1.5-2.5 Hz.
Now you can imagine what the phase will look like if a small or large piece of the signal is removed. In the first case, there will be a phase break — the frequency did not have time to change much (and if the removed piece is about 10-15 seconds, then the asymptotic behavior of the phase slope at a slightly changed frequency), in the second case — a phase break and a sharp change in the frequency of the harmonic under study.
An example that catches your attention: another expert examination is in production (currently in production): We listened, the impression is normal — no anomalies — the hand wants to write in the conclusions «There are no changes made during or after recording». Now let's look at it from a different angle. (Real examples from expert practice are placed in the Demo subdirectory on the laser disk, there are only two examples on the site — because they take up a lot of space)
Figure 9.
Here we see a sharp, jumpy change in frequency from 49.97446 to 50.06583, which is clearly visible on the frequency graph (brown color), respectively, the phase from this point went up (apparently, they cut out a little about a minute).
And here is another fragment of the same phonogram, the figure below.
Here is a full bouquet: both a phase break and a sharp change in frequency. At the moment, 6 places have been found (including 5 deletions and 1 insertion), and the study is not finished yet. Well, when we listened more closely to these six specific places, the linguist said that in two places a characteristic change in the acoustic environment was indeed detected (you understand this well when the soundtrack is more than 30 minutes long and you are told: listen to a specific place), although the noise level before and after remains unchanged, and there is no aliasing effect, there are also no signs of signal conversion from digital to analog representation, and there are no traces of the ADC filters (i.e. filter cutoffs) working. In general, professionally done.
Figure 10.
Harmonic interference
So, again we generate, for example, 50 Hz level 200 and 50.01 Hz level 300, mix them, see what happens. And we get harmonic interference.
Fig. 11.
What we observe: the upper graph is an oscillogram, below is the amplitude and phase, and even lower is the spectrum.
Please note: a dashed vertical grid is set and spread out along the amplitude minima, and the frequency value between individual vertical grids turned out to be 0.01 Hz (as can be seen in the window on the graph). And if you remember what we generated: 50.01-50=0.01 Hz – i.e. we see two closely spaced harmonics in frequency, with different amplitudes (calculating the parameters of frequency, phase, amplitude separately for each, looking at the figure, is elementary, i.e. simple 9th grade physics). As we were told in class: «and there should be a bifurcation of peaks on the spectrum…» — Let's look at this bifurcation on a window with more than 1,000,000 harmonics:
Fig. 12.
I don't see any splitting in the picture, do you? This is the principle (and not the only one, but that's another whole article) that determines whether a soundtrack is an original or a copy. When re-recording, a new 50Hz harmonic with a different frequency, amplitude, initial phase is added, and if their level is decent, then additional signs can be found in the case of editing. In order to consolidate this material, let us carefully examine several of the following drawings of the same fragment with different initial phases (so as not to confuse you — this is the same fragment, but from different angles of view, only the initial phase of viewing changes):
Fig. 13,14,15.
So, what do we see:
1. A clear phase break, and in several places in a row.
2. The amplitude (green graph) of the measured harmonic is approximately constant in sections, and in sections it begins to change according to an incomprehensible law.
3. Let's pay attention to the harmonic amplitude minima, markers are placed along them and correlate them with the moments of harmonic phase breaks in three figures.
If you look closely, then at each amplitude minimum, we have a phase break.
4. And if we look closely at the entire section where the harmonic amplitude changes, then at the beginning and at the end we find the same phase break. And so, this reminds us of something from the first figure in this section, Fig. 11.
If you carefully examined the figures, you will get the correct answer:
We have another fragment superimposed on the signal, with a different 50Hz frequency, with its own initial phase, different amplitude and its own law of change in amplitude and frequency over time. In places of amplitude minima, a phase shift is observed.
And why, you ask: how is it that they have different amplitudes? Here is the answer in the figure:
Figure 16
When two harmonics with the same amplitudes are added together at the moments of minimum amplitude, the phase changes by 180 degrees, and if their amplitudes differ, this shift decreases. In this way, it is possible to detect the presence of superposition of one phonogram on another, for example, a change in the acoustic environment (recorded indoors and superimposed an environment recorded outdoors or in nature — grasshoppers chirping or copied a phrase from one fragment and superimposed it in another place of the same or another phonogram).
Special features of the recording device
Let's look at the picture right away (I'll take the first soundtrack I find in the archive):
Pay attention to the grid and the phase. The phase turns out to be modulated by something. The vertical grid is set to the phase maxima (it can also be set to the frequency maxima — brown color). What can modulate the phase with a frequency of 1.18 Hz? — yes, the reel in the cassette rotates with this frequency. And if this sign remains when changing the cassette, then you understand that the left or right shafts on which the reels are put on rotate a little unevenly (or a tooth is dented in the LPM, or dirt got in, or the LPM is worn out). And if we find modulation with higher frequencies, then these are already beatings of other, high-speed shafts (in practice, 6.2; 12; 18.4; 24.3 Hz and other frequencies were detected, it all depends on the brand of the device and the looseness of the LPM). If you look closely at the frequency envelope, (brown color) we see frequency deviation, then there are still some beats.
Fig. 17
Let's dump the frequency (brown) envelope into a separate file, take its spectrum — and see the following
Fig. 18
Here they are!!! — LPM shafts, and somewhere around 1.18 Hz is also visible — there is a marker on it, you just need to look closely (if possible, open the recording device, count the teeth or measure the shaft diameters, you can find a corresponding spindle for each component — do not think that such pictures are visible on each record, and do not forget to first examine your own LPM, otherwise you will see yours, and write them off as someone else's). The amplitude of each component is different in two identical recording devices (even devices of the same brand are different). In the future, it is possible to examine phonograms for editing in this direction.
This article presented the main directions of research on editing (in a compressed form, otherwise the material will be enough not for an article, but for a separate book).
For beginners, a tricky question: «Where does the 50Hz component sometimes appear on a microcassette phonogram if it was recorded on a dictaphone?» Possible answers:
— or you are investigating your own interference that appeared during the digitization process.
— or you are dealing with a copy.
Well, have you chosen the correct answer? If yes, then look at the correct answer:
But you didn't guess, during microscopic examination it turned out that its amplitude changes, i.e. the amplitude is not fixed over time and changes when the location of the recorder changes (either in a purse, or taken out of a purse, put on a table, removed your hand from the recorder, moved it on the table, put the recorder in a purse, and when leaving the room the amplitude began to decrease exponentially and then disappeared altogether. So we are holding the original in our hands with 50 Hz interference.
Where can regular interference on a recorder or other device come from? From anywhere, even from a humming choke of a fluorescent lamp, or good electromagnetic interference.
Experiment, try, I will be glad to hear your developments or questions.