What question does tampering detection answer?
The core question is this: was the recording made on the claimed device, in the claimed way and without interruption? The examination looks at whether a section has been removed, whether material from another recording has been inserted, whether the order has been changed and whether the file has passed through editing software.
This question comes up frequently in disputes where an audio recording is submitted as evidence, in workplace internal investigations and with videos circulating on social media. For corporate incidents, see also the corporate internal investigation page.
Main service page for this topic: digital evidence examination
Examination methods
- Metadata and file structure: Creation information, recording device and software tags, and the box/block layout inside the container are examined; typical traces left by editing software are searched for.
- Codec and container traces: Encoding parameters, bitrate and signs of repeated compression (re-encoding) are compared with the device's native output.
- Spectral discontinuity analysis: The spectrogram is searched for abrupt starts and stops, phase breaks and sudden changes in frequency content.
- Background noise continuity: Room tone, hum and mains-related tones are checked for consistency throughout the recording.
- Frame timestamps: In video, frame durations, dropped or duplicated frames and audio-video sync are checked.
- Content consistency: Lighting, shadows, speech flow and ambient sounds are assessed together with the events described.
Why are results reported in terms of likelihood?
Every finding can have an innocent explanation. A messaging app, for example, recompresses a file before sending it; this strips metadata and leaves re-encoding traces, but it does not mean the recording was edited. Likewise, the recording device's own pause function can leave a discontinuity.
For this reason, instead of categorical statements such as "the recording has been edited", the report sets out separately which scenario the findings support, which they do not, and which questions cannot be answered with the available data. The court decides on the evidential weight of the report; my job is to present the technical findings clearly and in a way that can be checked.
- The absence of editing traces does not prove that a recording is definitely original.
- With copies that have been shared many times, the scope for examination is greatly reduced.
- If the device that made the recording can be provided, a comparison recording strengthens the result.
Which file should you bring?
The most valuable source is the original file on the device where the recording was first created. Copies sent via WhatsApp, Telegram or email will have lost a significant part of their metadata. If possible, the phone or recorder used should also be provided; a test recording made on the same device is a strong reference for comparison.
A SHA-256 hash of every file received is recorded, the originals are stored unaltered and all analysis is carried out on copies. For chain of custody and the overall process, see the digital evidence examination page.
Report and scope of authority
At the end of the examination, a technical report is prepared covering the methods, tools, hash values, findings and limitations. This report is an opinion obtained by a party from an expert of their own choosing; I explain how it is submitted in proceedings on the independent expert opinion page.
Examinations are carried out only at the request of the owner of the recording or persons legally entitled to it. Requests for covert access to someone else's device, password cracking or lock bypassing are not accepted. Examined data is kept confidential, handed back when the work is complete, and my copies are deleted.
What I offer
Metadata analysis
Device, software and container traces
Spectral examination
Abrupt cuts and phase breaks in audio
Background continuity
Consistency of room tone and hum
Frame timestamps
Dropped or duplicated frames and sync
Likelihood-based
Supported scenarios, not verdicts
Evidence integrity
SHA-256 hash and analysis on copies
Technologies I use
Example projects
A selection of live projects serving real users.
iPhone Security Scan — Spyware Detection
iOS app that scans for state-grade spyware, hidden tracking apps and jailbreak traces.
View
MobilEksper — Phone Inspection & Repair Shop Software
AI-assisted device inspection, IMEI and parts checks, repair service and inventory management.
ViewVELUX License Plate Recognition & Traffic Analytics
Smart plate recognition and traffic monitoring system.
ViewHow we work
Free intro call
We clarify needs, existing systems and goals together.
Quote & roadmap
Scope, technology, timeline and budget within 24 hours.
Staged development
Weekly demos and a live test environment.
Launch & support
Go-live, training and ongoing maintenance.
Free pre-analysisThe first meeting and roadmap are completely free, with no obligation.
Staged delivery and approvalYou review each module on a test environment before we move on.
Written scope and rightsScope, delivery and source code rights are defined in the contract.
Frequently asked questions
Can you tell whether an audio recording has been edited?
Signs of editing can be looked for by examining metadata, file structure, spectral discontinuities and breaks in background noise. The result is not always conclusive, however; findings are reported in terms of likelihood, together with the scenario they support.
Can tampering be detected in a recording sent via WhatsApp?
Yes, but only to a limited extent. Messaging apps recompress the file and strip much of its metadata. If possible, bring the original file from the device on which the recording was first made.
If no editing traces are found, is the recording definitely original?
No. The absence of traces means that no sign of editing was found with the methods available; it does not prove the recording is definitely original. The report makes this distinction explicit.
What is examined in video tampering detection?
Container and codec structure, re-encoding traces, frame timestamps, dropped or duplicated frames, audio-video sync and the consistency of lighting and sound in the scene.
Can your report be submitted to a court?
Parties can submit an opinion obtained from an expert of their own choosing. Under Turkish law (Code of Criminal Procedure Art. 67/6, Code of Civil Procedure Art. 293) this is provided for; procedures in other countries differ and should be clarified with a lawyer. The court decides on the report's evidential weight.
Do I also need to bring the phone that made the recording?
It is not mandatory, but it strengthens the result. A test recording made on the same device allows comparison of whether the file matches the device's native output.