Electric Network Frequency Analysis for Audio Dating

A power supply at 50 Hz or 60 Hz radiates an electromagnetic field that couples into any nearby conductor. In a recording environment, this coupling occurs through three main pathways. The first is direct mains coupling: a device powered from the wall draws current at the supply frequency, and the resulting electromagnetic field is picked up by the microphone, its cable, or the audio input circuitry, inducing a signal at the fundamental frequency and its harmonics. The second is acoustic coupling: electric motors, transformers, and lighting ballasts vibrate at the supply frequency and its harmonics, producing an audible hum that enters the microphone directly. The third is power supply ripple: even in battery-powered devices, if the device was previously charged or is near AC-powered equipment, residual coupling can occur, though at a lower level.

The ENF signal is usually weak relative to the main audio content, typically 20 to 60 dB below the signal level. This is sufficient for extraction using modern signal processing, but the analysis becomes harder as the signal-to-noise ratio falls. Recordings made in electrically quiet environments, such as battery-powered recorders outdoors, may have no detectable ENF at all. Conversely, recordings made in a room full of mains-powered equipment, or recorded directly from a mains-powered device without acoustic isolation, will have a strong and easily extractable ENF signal.

The frequency of the captured hum follows the grid frequency moment by moment. If the grid frequency rises from 50.00 Hz to 50.03 Hz over a ten-second window, the hum captured in the recording will show the same rise over the same window. This is what makes ENF a usable time reference: it is not the presence of hum that matters, but the precise trajectory of its frequency over time.

Extracting a clean ENF trace from a recording requires a processing pipeline that isolates the narrow frequency band of interest, tracks its instantaneous frequency at a fine time resolution, and outputs a time series suitable for database matching. The steps are standardised in the research literature and form the basis of most forensic ENF tools.

• Bandpass filtering: the audio is filtered to a narrow band around the expected ENF frequency, typically 49 to 51 Hz for a 50 Hz grid or 59 to 61 Hz for a 60 Hz grid. This suppresses the main audio content and reduces noise before further processing.
• Short-Time Fourier Transform (STFT): the filtered signal is divided into overlapping windows (commonly 1 second or 0.5 seconds) and a Fourier transform is computed for each window. The dominant frequency within each window is recorded, producing a series of frequency measurements at regular time intervals.
• Frequency estimation refinement: interpolation techniques such as parabolic interpolation around the STFT peak, or phase-based estimators, improve the frequency resolution beyond the bin width of the raw transform. This is important because the forensically useful variation in ENF is typically in the range of a few hundredths of a hertz.
• Outlier rejection: windows where the ENF signal is too weak to estimate reliably (low signal-to-noise ratio) are flagged and excluded from the comparison. A recording with too many such gaps may not yield a reliable match.
• Harmonic analysis: if the fundamental frequency band is noisy, the second or third harmonic (100 Hz or 150 Hz for a 50 Hz grid) may carry a cleaner signal. Combining estimates from multiple harmonics improves robustness.

The output is a time series of instantaneous frequency estimates, typically one value per second, spanning the length of the recording. This series is what gets compared against the reference database. The resolution of the series (one measurement per second vs one per 0.5 seconds) and the precision of each frequency estimate together determine how fine a time match can be established.

An ENF reference database is a continuous log of grid frequency measurements, sampled at a known rate (typically 1 Hz or higher) by the transmission system operator or a monitoring station connected to the grid. The forensic value of the database depends on three properties: its temporal coverage (how far back in time the record extends), its sampling resolution (how often frequency is measured), and its geographic coverage (whether it covers the specific grid segment where the recording was made).

Matching is performed by cross-correlating the extracted ENF time series against sliding windows of the reference database. The cross-correlation function peaks at the lag corresponding to the most probable recording start time. The height of the peak relative to the background level, and whether a single clear peak exists or multiple competing peaks appear, determines the confidence of the result. A short recording (under two minutes) will produce a wider and shallower peak, with more candidate time windows, than a long recording (over ten minutes) where the unique pattern of the ENF trace is more constraining.

Statistical significance testing converts the peak correlation into a probability statement. The analyst reports not just the most probable time window but the confidence interval around it, for example: the recording is consistent with having been made between 14:32 and 14:34 UTC on a specific date, with the next most probable match having a correlation coefficient 0.15 lower. Courts in the United Kingdom and United States have required this uncertainty quantification as part of admissible ENF testimony.

A continuous, unaltered recording will produce an ENF trace that matches a single unbroken segment of the reference database. Tampering leaves characteristic marks in the ENF trace that can be identified even without the reference database, though database comparison confirms and localises the anomaly.

The three main tampering signatures are deletion, insertion, and splicing. A deletion occurs when a segment of the recording is removed and the surrounding audio is joined. In the ENF trace, the phase of the frequency signal will jump at the cut point: the signal that continues after the join will not be the natural continuation of the signal before it. The join will also often appear as an amplitude discontinuity in the ENF band, though this is a secondary indicator. An insertion occurs when audio from a different recording is placed into the middle of the original. The inserted segment will carry an ENF trace from a different time window, which will not match the reference database at the claimed time of the original recording; the inserted segment may match the database at a completely different time. A splice from a different grid, for example, inserting audio recorded in Germany into a recording claimed to have been made in the United Kingdom, will show a segment with 50 Hz ENF (consistent in grid frequency) but with a frequency trajectory that matches the Continental European synchronous area rather than the Great Britain grid, distinguishing the two because they are not synchronised to each other.

Phase-based detection methods are more sensitive to small deletions than frequency-only methods. If a deletion removes only a few seconds, the frequency trajectory may not shift noticeably, but the phase of the sinusoidal ENF component will be displaced by an amount proportional to the deleted duration. Analysts working on suspected short-segment deletions should use phase analysis rather than frequency-only matching for this reason. See also audio recording discontinuity detection for complementary methods based on microphone and background noise signatures.

ENF analysis fails when the ENF signal is absent or too weak to extract reliably. This happens in several circumstances: outdoor recordings with battery-powered devices, heavily shielded studios, recordings made on grids with very stable frequency (the variation is too small to be unique), and recordings that have been processed with filters or compression that attenuates the ENF band. The analyst must first confirm that an extractable ENF signal exists before proceeding to matching; reporting a negative match when no signal was present is a methodological error.

Reference database gaps create a second class of failure. If the recording was made during a period not covered by the available reference data, no match can be found. This is particularly relevant for historical recordings, recordings from countries with limited TSO data retention, and recordings from isolated microgrids (ships, remote facilities) where the frequency behaviour is determined by local generators rather than a national grid. Synchronous grid zones, such as Continental Europe, share a frequency that is identical across hundreds of thousands of square kilometres, which is useful for establishing grid membership but prevents geographic localisation within the zone.

A third limitation concerns adversarial manipulation. A sophisticated actor who is aware of ENF forensics could, in principle, suppress the captured ENF hum, or re-synthesise a consistent ENF trace matching a different time after editing. Suppression is difficult without degrading the audio, but ENF re-synthesis has been demonstrated in research as a potential anti-forensic technique. Courts should be aware that a clean ENF trace is not absolute proof of authenticity; it is one layer of evidence within a broader authentication framework that should also include chain-of-custody documentation, metadata examination, and complementary signal-level analysis.

ENF evidence has been admitted in courts in multiple jurisdictions. In the United Kingdom, the technique has been used in criminal proceedings and accepted as expert scientific evidence under the Criminal Procedure Rules, which require the expert to explain the method's basis, limitations, and uncertainty. In the United States, ENF evidence has been presented under the Daubert framework, which requires the court to evaluate the technique's testability, peer review status, known error rate, and general acceptance in the relevant scientific community. ENF analysis satisfies all four Daubert criteria: the method is described in peer-reviewed literature, the error rate depends on recording length and can be quantified, and it is accepted in the forensic audio community.

In India, digital records including audio are governed by the Bharatiya Sakshya Adhiniyam 2023 (which replaced the Indian Evidence Act 1872), which recognises electronic records as evidence and permits expert testimony on their authenticity. Sections 63 and 65B of the predecessor act, and their equivalents in the 2023 Adhiniyam, require a certificate attesting to the conditions under which electronic evidence was produced; ENF analysis reports should accompany this certificate rather than substitute for it. In the European Union, the eIDAS Regulation and national implementing laws govern electronic evidence authenticity, and ENF analysis functions as expert scientific evidence within those frameworks. In each jurisdiction, the operative requirement is that the expert explain the method, its assumptions, and the basis for the conclusion clearly enough that the court can assess its weight.

Chain of custody requirements apply to ENF analysis as to any other forensic method. The reference database segment used for comparison should be obtained and preserved as an exhibit, with provenance documentation from the TSO or other source. See chain of custody for digital media for the general framework. The extracted ENF trace, the comparison algorithm parameters, and the statistical output should all be documented in the examination record so that an independent analyst can reproduce the result. Reproducibility is consistently required by courts that have admitted ENF evidence.