In this study, we propose an advanced forensic examination procedure for audio recordings generated by the Voice Memos application with iPhone Operation System (iOS)14, to verify that these are the original recordings and have not been manipulated. The proposed examination procedure consists of an analysis of the characteristics of audio recordings and of the file system of the device storing the audio recordings. To analyze the characteristics of audio recordings, we compare the encoding parameters (bitrate, sampling rate, timestamps, etc.) and the file structure to determine whether audio recordings were manipulated. Next, in the device examination step, we analyze the media-log history and temporary files of the file system obtained by mobile forensic tools. For comparative analysis, a total of 100 audio recording samples were obtained through the Voice Memos application from five iPhone mobile handsets of different models with iOS14 installed using Advanced audio coding (AAC) or Apple lossless audio codec (ALAC). As a result of analyzing the encoding parameters between the original and manipulated audio recordings, as well as the temporary files contained in the device file system, the difference in the encoding parameters and the very unique trace of the original audio recordings in the temporary files were confirmed when manipulating the audio recordings. In particular, the primary advantage of our proposed method is its potential ability to recover original audio recordings that were subsequently manipulated via the temporary files examined in the device file system analysis.
Keywords: audio forensics; audio forgery detection; authentication of audio recordings; forensic integrity; iOS14; manipulation-related temporary files.
© 2022 American Academy of Forensic Sciences.