Microphone and Codec Identification in Audio Forensics

A microphone converts acoustic pressure variations into an electrical signal. The fidelity and coloration of that conversion depend on the capsule design, the diaphragm material and size, the polar pattern, and the housing geometry. These physical parameters are not arbitrary: they are engineering constraints that produce predictable and measurable frequency response characteristics.

MEMS microphones, standard in smartphones and laptops, use a microscale silicon diaphragm over a fixed backplate. They produce a characteristically flat response from around 100 Hz to 10 kHz, with a gentle high-frequency roll-off and a steeper low-frequency roll-off below 100 Hz. Their self-noise floor is relatively high compared to studio condenser microphones, typically 58 to 68 dB(A) equivalent input noise. Electret condenser microphones, used in many conference systems and consumer recorders, share the backplate structure but use a charged polymer diaphragm; their response extends higher and their self-noise is lower. Dynamic microphones, common in broadcast and body-worn surveillance units, use electromagnetic induction; they have a narrower high-frequency response and a characteristic proximity effect that boosts low frequencies at close range.

Forensic examiners build frequency response profiles from recordings made in controlled conditions, comparing the average spectral shape of silent passages and low-signal segments against device reference databases. The comparison is statistical rather than absolute: noise floor measurements are averaged over multiple frames, and roll-off slopes are fitted to reference curves. The result is a probability-weighted assignment to a device class, not a serial-number-level identification. However, class attribution is often sufficient for forensic purposes: establishing that a recording's microphone characteristics are inconsistent with an iPhone 14 rear microphone but consistent with a lapel condenser microphone can contradict a witness's account of how the recording was made.

Lossy audio codecs compress data by applying a psychoacoustic masking model: they identify frequency components that are perceptually masked by louder nearby components and either discard them or quantise them coarsely. The specific sub-band structures, masking thresholds, and quantisation step sizes differ by codec family (MP3, AAC, Ogg Vorbis, Opus, WMA) and by the target bitrate within each family. These differences leave measurable spectral signatures.

The most forensically useful signature is the spectral ceiling: the highest frequency present in a recording. A 128 kbps MP3 file typically cuts off sharply at around 16 kHz because the encoder's psychoacoustic model drops those components at that bitrate. If a file is presented as an original 44.1 kHz WAV recording but its spectrum shows an abrupt cut-off at 16 kHz, the file has been down-converted from an MP3 at some point, even though it is now packaged as a lossless format. This is a simple but highly reliable indicator of intermediate lossy compression.

Within a codec family, different bitrate settings produce different cut-off frequencies and different quantisation noise distributions. A 64 kbps MP3 cuts off below 14 kHz; a 192 kbps MP3 may extend to 18 kHz or above. The bitrate can therefore be estimated from the spectral ceiling, though some encoders apply variable bitrate (VBR) settings that produce a distribution of cut-off frequencies across the file. The encoder implementation also matters: LAME, FhG, and iTunes AAC produce subtly different quantisation patterns even at the same nominal bitrate. Encoder identification from these patterns has been demonstrated in research settings and is beginning to appear in casework.

Double compression is the condition in which a file has been encoded with a lossy codec, decoded to PCM, and then re-encoded, either with the same codec at a different bitrate or with a different codec. Each encoding pass leaves its own set of quantisation artefacts. When the second pass encodes data that already contains the first pass's artefacts, the second encoder's masking model interacts with the residual distortion from the first pass, producing a characteristic interference pattern.

The detection method depends on the codec combination. For MP3-to-MP3 double compression, the most reliable indicator is the distribution of quantisation noise across the MP3 frame boundaries: a singly-encoded file shows consistent noise statistics across frames, while a doubly-encoded file shows a periodic variation that corresponds to the first encoder's frame structure being partially preserved through the second encoding pass. This is detectable even when the second encoding is at a higher bitrate than the first, a scenario sometimes called up-encoding that is used to disguise the compression history of an edited file.

Cross-codec double compression, such as AAC followed by MP3, is detectable through the combined spectral signatures. The AAC spectral envelope shaping will be present in the residual, and the MP3 MDCT block structure will be superimposed on it. These combined artefacts are more complex to interpret but remain detectable with spectral analysis software such as Adobe Audition's spectral display, Sonic Visualiser with the appropriate plugin set, or specialist forensic tools including Praat for pitch-related analysis and hex editors for container-level bitstream inspection.

Beyond spectral analysis of the decoded audio, the encoded bitstream itself carries metadata that can be examined directly. MP3 files contain frame headers at fixed intervals; each header specifies the bitrate, sample rate, channel mode, and encoder flags used for that frame. Inconsistencies between headers in the same file, or between the headers and the container-level metadata, indicate that the file has been assembled from multiple sources or has been partially re-encoded.

AAC files in the M4A or MP4 container carry an ESDS (Elementary Stream Descriptor) atom that records the encoder configuration. WAV and AIFF files carry format chunks specifying sample rate, bit depth, and channel count. These container-level fields are sometimes modified by editing software independently of the audio data, producing a mismatch that is itself forensically informative: a WAV file claiming 44.1 kHz sample rate but containing audio with a 16 kHz spectral ceiling was not recorded at 44.1 kHz with that spectrum intact.

ID3 tags in MP3 files and XMP or EXIF metadata in other containers can carry recording date, device model, and encoder version strings. These fields are user-writable and are therefore unreliable as standalone evidence, but they can be cross-checked against the technical signatures in the audio data. A file whose ID3 tag claims to be recorded by a specific smartphone model but whose microphone signature is inconsistent with that model's known characteristics presents an evidentiary contradiction that warrants investigation. Metadata analysis for audio files follows the same chain-of-custody principles as for image files, as covered in the authentication and integrity fundamentals for multimedia evidence.

AI voice synthesis systems, including text-to-speech engines and voice conversion models, generate audio from neural network outputs rather than from a physical acoustic source. Early synthesis systems produced audio with unrealistic spectral flatness above 8 kHz, consistent background noise levels that do not vary as a real room's acoustics would, and a complete absence of the microphone self-noise that all physical recordings carry. These absences were reliable detection features.

Current synthesis systems are more sophisticated. Some apply convolution reverb to simulate room acoustics, add synthesised microphone noise at levels calibrated to match specific device classes, and encode through real codec pipelines to produce files that carry plausible compression signatures. Detection therefore requires looking for inconsistencies rather than mere absences: for instance, microphone self-noise that is statistically too consistent across frames (real microphone noise is a random process and shows natural variation), room acoustics that do not match the reported recording location, or pitch periodicity patterns that are subtly different from natural phonation.

Voice cloning, in which a synthesis model is conditioned on a target speaker's voice, presents an additional layer of complexity. The prosody and spectral content of the cloned voice may closely match the genuine speaker, making perceptual detection unreliable. Microphone and codec analysis contributes to detection by identifying whether the recording's physical signatures are consistent with a genuine recording by that speaker in the claimed context. The topic of voice conversion and cloning detection covers the signal-level classifiers designed specifically for that task.

Audio authentication findings are admissible in courts across multiple jurisdictions, but the standards for admissibility and presentation differ. In the United States, the Federal Rules of Evidence require that expert testimony rest on sufficient facts or data, be the product of reliable principles and methods, and that the expert has applied those methods to the facts of the case (Daubert standard, Kumho Tire v Carmichael 1999). The Audio Engineering Society standard AES27 provides a reference framework for authentication methodology. The Scientific Working Group for Digital Evidence (SWGDE) publishes technical guidelines that courts have cited in assessing reliability.

In the United Kingdom, the Forensic Science Regulator's Codes of Practice and Conduct require accredited laboratories to follow documented procedures and to disclose the uncertainty in their findings. In India, Section 63 of the Bharatiya Sakshya Adhiniyam 2023 requires a certificate of authenticity for electronic records tendered as evidence; the certificate must identify the device, the method of production, and the person certifying the record. Across the European Union, ISO/IEC 27037 provides the international standard for digital evidence handling and is increasingly referenced in court decisions concerning digital evidence. These are not isolated requirements: the core obligation in every jurisdiction is to document the chain of custody, the analytical method, the tools used, and the basis for each conclusion, so that another qualified examiner could reproduce the analysis and evaluate the findings.

Expert reports should state the limitations of device-class identification clearly. Spectral fingerprinting places a recording within a class of microphones; it does not establish that the recording came from a specific device. Double compression detection establishes that intermediate encoding occurred; it does not establish when, by whom, or for what purpose. These distinctions matter for how findings are framed in testimony. Overstating the specificity of a class-level attribution is a common error that opposing experts and careful judges will identify.