ANALYSIS OF AUDIO RECORDINGS MADE USING THE VOICE RECORDER APPLICATION ON
ANDROID PHONES
by
GINA ANTOINETTE DEANGELIS
A.A., Arapahoe Community College, 1999
B.S., University of Colorado Denver, 2001
A thesis submitted to the
Faculty of the Graduate School of the
University of Colorado in partial fulfillment
of the requirements for the degree of
Master of Science
Recording Arts Program
2020
ii
© 2020
GINA ANTOINETTE DEANGELIS
ALL RIGHTS RESERVED
iii
This thesis for the Master of Science degree by
Gina Antoinette DeAngelis
has been approved for the
Recording Arts Program
by
Catalin Grigoras, Chair
Jeff M. Smith
Marcus Rogers
Date: May 16, 2020
iv
DeAngelis, Gina Antoinette (M.S., Recording Arts)
Analysis of Audio Recordings Made Using the Voice Recorder Application on Android
Phones
Thesis directed by Associate Professor Catalin Grigoras
ABSTRACT
Android is one of the two main operating systems for mobile phones and includes
an application for voice recording. Since extensive research has been completed on the
"Voice Memos" application for iOS, there remains research to be completed on the default
application for the Android OS. This thesis explores the user interface for four different
Android phones with four different voice recording application versions. Features,
limitations, editing capabilities, file formats and atom structure for each phone are
discussed. A testing protocol was created and utilized for the creation of the test
recordings. The analysis of those recordings explored authenticity, detected editing and
discovered consistencies and inconsistencies between the recordings for each phone.
The form and content of this abstract are approved. I recommend its publication.
Approved: Catalin Grigoras
v
DEDICATION
This is dedicated to my parents and my boys who supported me every step of the way.
Your sacrifices did not go unnoticed.
vi
ACKNOWLEDGEMENTS
First, I would like to thank Rich Sanders who first introduced me to audio forensics.
His passion for audio and his brilliance were inspiring and I wish I hadn’t waited 16 years
to finally see this through. You are truly missed!
Secondly, to my mom who helped proofread and edit all my papers from elementary
school all the way through this thesis. Your dedication and support have been incalculable.
I could not have done this without you!
To Andrew Hill whose thesis, “Analysis of Audio Recordings made using “Voice
Memo’s” Application for iOS”, was the backbone for this thesis; thank you for all your hard
work. To Douglas Lacey, Jeff Smith, Catalin Grigoras and Bruce Koenig whose conference
paper on “Triage Approach for the Forensic Analysis of Apple iOS Audio Files Recorded
Using the “Voice Memos” App”, was also key in the development of this paper. Thank you
for your dedication to the field.
Lastly, I would like to thank everyone at the NCMF your support was instrumental.
To my 17-19 cohort, thank you for all your support, encouragement and “late night
seminars”. I feel very honored and privileged to be a part of such a great group! A special
shout out to Doug thank you for the hours spent with me over the phone, over the
computer and via email “holding my hand”. You mentored me and helped me laugh
through the most stressful times of the program. I hope to repay the favor someday.
To my Heavenly Father who made everything possible, thank you!
vii
TABLE OF CONTENTS
CHAPTER
I. INTRODUCTION ...................................................................................................................................... 1
Android Devices................................................................................................................................. 3
Previous Research ............................................................................................................................ 3
II. VOICE RECORDER USER INTERFACE ............................................................................................. 5
Device #1: HTC One, Android 5.0.2 Lollipop, Voice Recorder 6.3.843363 ................. 5
Editing ........................................................................................................................................... 10
Device #2: LG Q6, Android 7.1.1 Nougat, Audio Recorder 6.1.8 .................................. 10
Features and File Formats .................................................................................................... 10
Editing ........................................................................................................................................... 14
Device #3: Samsung Galaxy S6, Android 7.0 Nougat, Voice Recorder 20.1.86.12 17
Device #4: Samsung Galaxy S9, Android 10, Voice Recorder 21.2.00.42 ................. 17
Features and File Formats .................................................................................................... 18
Editing ........................................................................................................................................... 21
Interrupted Recordings with Phone Calls....................................................................... 23
III. TEST RECORDING PROTOCOL ....................................................................................................... 24
LG Q6 ................................................................................................................................................... 24
Samsung S6 and S9 ........................................................................................................................ 25
IV. RESULTS .................................................................................................................................................. 26
Device #1: HTC One ...................................................................................................................... 27
Device #2: LG Q6 ............................................................................................................................ 30
Consistencies and Inconsistencies..................................................................................... 30
viii
Atom Structure .......................................................................................................................... 31
Device #3: Samsung S6 ................................................................................................................ 31
Consistencies and Inconsistencies..................................................................................... 31
Atom Structure .......................................................................................................................... 32
Device #4: Samsung S9 ................................................................................................................ 34
Consistencies and Inconsistencies..................................................................................... 34
Atom Structure .......................................................................................................................... 34
V. CONCLUSION ......................................................................................................................................... 36
Future Research.............................................................................................................................. 36
REFERENCES ....................................................................................................................................................... 38
APPENDIX
A. TEST RECORDING COLLECTION PROTOCOL FOR LG Q6 .................................................... 39
B. TEST RECORDING COLLECTION PROTOCOL FOR SAMSUNG S6 AND S9 ..................... 43
ix
LIST OF TABLES
TABLE
1: Mobile Phone Overview ................................................................................................................................. 2
2: Digital Audio Specifications ......................................................................................................................... 5
3: Comparison of Unedited and Edited Recordings on the Q6 ......................................................... 31
4: Comparison of Unedited and Edited Recordings on the S6 .......................................................... 33
5: Comparison of Unedited and Edited Recordings on the S9 .......................................................... 35
x
LIST OF FIGURES
FIGURE
1: Voice Recorder App Icon ............................................................................................................................... 5
2: Voice Recorder User Interface .................................................................................................................... 6
3: Voice Recorder While Recording ............................................................................................................... 7
4: Renaming Options ........................................................................................................................................... 7
5: Recording Options ........................................................................................................................................... 8
6: File Format Options......................................................................................................................................... 9
7: Audio Recorder App Icon ........................................................................................................................... 10
8: Audio Recorder User Interface ................................................................................................................ 11
9: Audio Recorder While Recording ........................................................................................................... 12
10: Recording Default Name .......................................................................................................................... 12
11: Recording Options...................................................................................................................................... 13
12: Details of the Recording ........................................................................................................................... 14
13: Finished Recording .................................................................................................................................... 15
14: Editing the Beginning and Ending of the Recording ..................................................................... 16
15: Editing the Middle of the Recording ................................................................................................... 16
16: Voice Recorder App Icon ......................................................................................................................... 17
17: Voice Recorder User Interface............................................................................................................... 19
18: Voice Recorder While Recording ......................................................................................................... 19
19: Recording Options...................................................................................................................................... 20
20: File Format Options ................................................................................................................................... 20
21: Editing Markers ........................................................................................................................................... 21
xi
22: Editing Options ............................................................................................................................................ 22
23: QuickTime File Format Movie Atom Example ................................................................................ 26
24: Edited Audio in Voice Recorder ............................................................................................................ 28
25: AMR-NB Hex Data ...................................................................................................................................... 28
26: AMR-WB Hex Data ..................................................................................................................................... 28
27: AAC Hex Data ............................................................................................................................................... 29
28: Header Information in Hex Editor ....................................................................................................... 30
29: Footer Information .................................................................................................................................... 30
30: Hex Data Header of Unedited Recording........................................................................................... 32
31: Hex Data Header of Edited Recording ................................................................................................ 33
1
CHAPTER I
INTRODUCTION
Android smartphones, developed by Google, were first released in September 2008
with the T-Mobile G1 (in the US) or HTC Dream (in the UK and Europe). From version 1.0
to Android 11 (due to be released during the third quarter of 2020) the operating system
(OS) has undergone major changes over the years. One of the unique traits of the Android
OS is that each version (up to 10) was associated with a dessert, i.e., Android 5.0 Lollipop,
6.0 Marshmallow, 7.0 Nougat, and 9.0 Pie. Android 10.0 introduced a new look to the
Android brand, including a new logo and abandoning the dessert name [1].
By 2018 “of the 1.56 billion smartphones sold worldwide in 2018, around 1.35
billion were running the Android operating system” [2]. One of the main reasons for this is
that Android is an open-source platform, allowing mobile phone manufacturers to adapt
the OS for their own devices, which includes Samsung, Nokia, Motorola, HTC, LG, Google
Pixel and others.
The development and popularity of all mobile phones, Android and iOS (iPhone
Operating System), means that they are easily accessible and readily available for just
about any need. The size of and the growing dependence of society on mobile phones
makes them available and utilized everywhere. Between the millions of apps available for
download on the Android phone and the built-in capabilities, including the built-in camera,
GPS, calling, texting, and video/audio recorders, the uses are endless.
“Mobile forensics, arguably the fastest growing and evolving digital forensic
discipline, offers significant opportunities as well as many challenges” [3]. Their ability to
track locations, phone calls, texts and other types of communication can make them key
2
components to an investigation. The abilities to properly identify, examine, and verify
information from a mobile phone are very important aspects of forensic research.
Different applications and their abilities are also important to research and understand, not
just for the scientific community, but also for individuals who use these devices every day.
This paper explores the capabilities of the voice recording application that comes
standard on the Android phone. Four different Android phones with four different
versions of the app were tested for recording and editing capabilities and different
characteristics for each device were investigated. This is merely a preliminary study to
determine the feasibility of these applications. It is important to verify authentication and
provenance, as well as consistencies and inconsistencies between the devices.
Table 1: Mobile Phone Overview
PHONE
ANDROID
VERSION
VOICE RECORDER VERSION
HTC ONE
5.0.2
6.3.843363
SAMSUNG GALAXY S6
7.0
20.1.86.12
LG Q6
7.1.1
6.1.8
SAMSUNG GALAXY S9
10.0
21.2.00.42
All devices tested allow the ability to share the recordings via messages, email,
Android Beam, Bluetooth, and Gmail. The Samsung phones also allow sharing via Outlook,
OneNote, Samsung Cloud Drive and many others depending on what other communication
apps are installed on the phone. All devices, except for the LG Q6, allow the files to be
renamed, deleted, shared and a few other options. All devices, except for the HTC One,
allow for some type of editing, which will be discussed in further detail later.
Testing protocols were established for the LG and Samsung phones since their voice
recording apps offer the most features (see Appendix A and Appendix B).
3
Android Devices
In order to conduct a preliminary survey of Android Voice Recorder apps, the
following Android devices were investigated for this study:
HTC One Sense, PN072, released in March 2015, Android version 5.0.2 Lollipop
Samsung Galaxy S6, SM-G920P, released in April 2015, Android version 7.0 Nougat
LG Q6, GL-US700, released in March 2017, Android version 7.1.1 Nougat
Samsung Galaxy S9, SM-G960U, released January 2018, Android version 9.0 Pie
(updated to 10.0 during this study)
Since there are hundreds of different Android phones it would be impossible to
conduct a survey of all these phones for the scope of this paper; however, the phones listed
above supplied adequate information as a starting point for further research on other
models.
The LG Q6, as mentioned above, does have the ability to add Location and Event
Tags to the recording, but since there was no cell service provided for this phone during the
time of testing, those options were not available. Only the Samsung S9 had service, and so
it was the only one utilized to test interruptions on the app with incoming calls.
Previous Research
At the AES International Audio Forensics Conference in 2017, Jeff Smith, Catalin
Grigoras, Douglas Lacey and Bruce Koenig presented a paper entitled “Triage Approach for
the Forensic Analysis of Apple iOS Audio Files Recorded Using the ‘Voice Memos’ App” [4].
This paper described the testing of recordings captured, edited and interrupted on iPhones
to determine the functionality of the app. Based upon the data collected, a decision tree
was then created to assist with the examinations of file originality.
4
Andrew Hill, in his thesis, “Analysis of Audio Recordings Made Using ‘Voice Memos’
Application for iOS[5], expanded upon the research conducted by Smith, Grigoras, Lacey
and Koenig. Both Hill’s thesis and the conference paper were limited to the iOS.
This thesis takes the general concepts from the conference paper and Hill’s thesis
and applies them to the Android OS. There were many features that were different
between the “Voice Memos” app on the iOS and the “Voice Recorder” app on the Android
OS. The goal was not to compare the two OS’s but to explore the “Voice Recorder” app on
the Android as had the previous work on the iOS. The features and functions, as well as the
limitations of the “Voice Recorder” app, will be discussed in the next chapter.
5
CHAPTER II
VOICE RECORDER USER INTERFACE
All phones investigated had unique audio encoding and container properties. Audio
encoding algorithms determine how the file will be encoded (written) and decoded (played
back). The container (wrapper) specifies how the media data and metadata is organized
[5]. The table below gives an overview of all phones and their file formats. It also includes
their bit rate and sample rate. Each one is discussed in detail with each phone that was
tested.
Table 2: Digital Audio Specifications
PHONE
ENCODING
CONTAINER
BIT RATE
(kbps)
SAMPLE
HTC One
AMR-NB
AMR
12.8
AMR-WB
AMR
12.8
AAC-LC
MPEG-4
128
LG Q6
AAC-LC
m4a
96
S6 AAC-LC m4a
64
128
256
S9 AAC-LC
m4a
64
128
256
Device #1: HTC One, Android 5.0.2 Lollipop, Voice Recorder 6.3.843363
Figure 1: Voice Recorder App Icon
6
Features and File Formats
This version of the Voice Recorder app has several different options and settings for
the audio recordings. It contains the basic controls of “record”, “pause”, “stop”, and play”.
Once a recording is made, the user is prompted to keep the default name or to rename it
(Figure 4). There is also an option to rename the file later if needed. The audio file can be
shared through several communication applications including but not limited to: messages,
drive, email, Gmail and others depending on what is installed on the phone. The files can
also be deleted and removed from the app. (It is unknown whether the phone retains the
audio recording or not, that was outside the scope of this paper.) The app also allows the
user to set the audio recording as a ringtone (see Figure 5).
Figure 2: Voice Recorder User Interface
7
Figure 3: Voice Recorder While Recording
Figure 4: Renaming Options
8
Figure 5: Recording Options
The Voice Recorder app on the HTC One records only in mono from the built-in
microphone, but allows for three different file formats: normal quality which is Adaptive
Multi-Rate Narrowband (AMR-NB), better quality which is Adaptive Multi-Rate Wideband
(AMR-WB) (this is the device’s default setting) and high quality which is Advanced Audio
Coding Low Complexity (AAC-LC) (Figure 6). All of the above formats are lossy
compression formats, which means the quality of the recording is diminished and data is
lost (that cannot be retrieved in its original form) in order to save on the file size. This
allows for less storage space to be used on the phone. Lossless compression is another
type of compression that contains more information on the audio file, giving the ability to
reconstruct the full quality of the audio without any loss [6]. The drawback for lossless
compression is the file size. Lossless compression file sizes are not practical for mobile
9
phones. Since the HTC One does not have any external memory options, file size can
become a factor if the user is planning on storing a large amount of information on this
device.
AMR-NB and AMR-WB are common audio compression formats in mobile phones.
ACC-LC is another very common file format that compresses the file size. While these file
formats will not sound any different to the average listener, in a good quality listening
environment they can lose depth and richness since the quality of the audio has been
affected to save on file space.
Figure 6: File Format Options
10
Editing
The Voice Recorder does not have any editing capabilities. There are no options to
trim or delete any section of the recording. The user also cannot record over a previous
recording in part or in whole. However, a voice recording can be downloaded to the
computer, edited in a third-party editing software, and then downloaded again to the app
as long as the edited file is saved as any of the available file formats.
Device #2: LG Q6, Android 7.1.1 Nougat, Audio Recorder 6.1.8
Figure 7: Audio Recorder App Icon
Features and File Formats
LG labeled their recording app the Audio Recorder, but it has similar features and
functions as the other Androids that were tested. It, too, retains the ability to “record”,
“pause”, “stop” and “play”, as well as a bookmark tool that can be used during or after a
recording. Before a recording is made, there is an option to add Event or Location tags.
This permits the recording to be attached to an event on the user’s calendar or the location
information will be included in the details of the file. Since this phone did not have service
at the time of testing, these features were not tested.
The recordings are automatically saved when the recording is stopped and are
saved under a default name that can later be renamed. The recordings can be shared via
Android Beam, Bluetooth, or through various communication apps like Gmail, messages,
11
and can also be saved in the app QuickMemo+ (which comes standard on the phone). Like
the HTC One, recordings can be deleted, and they will no longer be available in the app.
The Q6 phone can only record in mono and has one file format: AAC-LC at 96
kilobytes per second (kbps) 44.1kHz sample rate. This phone does offer the capacity for
external storage and the app grants the user a choice of internal or external memory before
starting the recording; however, once the recording is made, it cannot be moved to the
other storage unit.
Figure 8: Audio Recorder User Interface
12
Figure 9: Audio Recorder While Recording
It is interesting to note that the default save name includes the date of the recording
as the beginning numbers but ends with “Normal” (Figure 10). This would leave the user
to believe that there are other recording settings besides the default setting, but after
further investigation there are no other quality settings.
Figure 10: Recording Default Name
By pressing and holding a specific recording, a new window pops up allowing the
user to delete the recording, set it as a ringtone, or view the details of the recording (Figure
11).
13
Figure 11: Recording Options
The details page (Figure 12) shows the user the title of the recording, the size of the
file, the date and time of the recording, the type of file, the duration, and the path where the
file is saved.
14
Figure 12: Details of the Recording
Editing
The LG Q6 does have editing capabilities. Once the recording has been completed
and saved the user can select the scissors icon (Figure 13) to edit the selected recording.
The user can share the file or delete the file here as well.
15
Figure 13: Finished Recording
Once the scissors icon is selected, the start and edit points can be moved to the
desired location. For this particular app the beginning and ending of the recording can be
trimmed. Simply select the location for the edit (the highlighted area). Once the settings
are correct, the user can select the check icon and the highlighted area will be saved; so, the
area left outside the recording will be saved. (If the x icon is selected, the editing window
will exit, and the list of recordings will now be visible). In Figure 14 below, the beginning
of the file and the end of the file are saved.
16
Figure 14: Editing the Beginning and Ending of the Recording
When it comes to the middle section of the recording, it is possible to select the
middle section (Figure 15) and save what has been selected deleting before and after that
area. It is not possible to delete the middle section of the recording and have the beginning
and ending spliced together.
Figure 15: Editing the Middle of the Recording
17
It is not possible to delete (cut) a section of the recording and add (paste) it
somewhere else in the recording or add it to another recording. It is also not possible to
record over a previous recording, in part or in the whole; however, when editing has been
done to the recording, the option for saving is to create a new file or overwrite the original.
If creating a new file is selected, the user can keep the default name or rename the file then.
Device #3: Samsung Galaxy S6, Android 7.0 Nougat, Voice Recorder 20.1.86.12
Device #4: Samsung Galaxy S9, Android 10, Voice Recorder 21.2.00.42
Figure 16: Voice Recorder App Icon
Even though both phones were different Android versions and the Voice Recorder
app was different versions the interface was identical in look and ability. So, these two
phones were grouped together for the testing protocol. This Voice Recorder app is the
most user friendly and has the most editing capabilities.
Before the testing on Android 9 could be completed, the phone updated overnight
from Android 9 to 10 and the Voice Recorder app was also updated from version
21.1.06.11 to 21.2.00.42. The recordings that were completed before the update have been
included in this paper, but they are not as extensive as the recordings completed for
Android 7 and 10. The S9 did have service during the testing and so interruptions from
incoming calls were also tested. The S6 does not have the capability for external storage;
however, the S9 does.
18
Features and File Formats
The Voice Recorder app includes the basic audio controllers, “record”, “pause”,
“stop” and “play”. This version offers a Standard Mode, an Interview Mode and a Speech-
to-text Mode (Figure 17). The Standard Mode was used for the testing protocol. The
Interview Mode records from both mics on the top and bottom of the phone (which did not
reveal anything different from Standard Mode with a stereo setting when examined), and
the Speech-to-text Mode was not tested since it is outside the scope of this paper.
Bookmarks and blocking calls while recording are other features that this version includes.
It also features different playback options: skip muted sections, repeat the recording, and
change the speed of the playback from x0.5 to x2.0, the normal speed is x1.0.
The S6 and S9 allow the user to share the recordings through communication apps
such as Messages, Mail, Gmail, Messenger (FB) and Outlook, and via Android Beam,
Samsung Cloud Drive, Bluetooth, Samsung Notes, and Samsung Drive. These phones also
offer the capabilities to edit, rename, delete, convert speech-to-text, move to a secure folder
and display the details of the recording (Figure 19).
The Voice Recorder for the S6 and the S9 grants three different file formats, all of
which can be recorded in mono or stereo: Low quality (64kbps, 44.1kHz), Mid quality
(128kbps, 44.1kHz), and high quality (256kpbs, 48kHz) (Figure 20). All recordings are
saved as an m4a, which is another common container file format.
19
Figure 17: Voice Recorder User Interface
Figure 18: Voice Recorder While Recording
20
Figure 19: Recording Options
Figure 20: File Format Options
21
Editing
The editing capabilities of the Voice Recorder for the S6 and the S9 offer the most
options of all the recording apps tested. These phones offer the option to delete the
beginning, the middle and the end of the recording. Once the recording is saved, the user
can select “Edit” and then editing markers can be placed wherever needed (Figure 21).
Figure 21: Editing Markers
The user then selects the scissors icon and has two options: “Delete selected area” and
“Delete dimmed area”. Ifdelete dimmed area” is selected, the area that is barely visible
will be deleted. In Figure 22 the dimmed area is the beginning and the ending of the
recording, so the area that is selected will be saved.
22
Figure 22: Editing Options
If the middle of a recording is deleted, then the beginning and ending are spliced
together. If the middle of the recording is selected, then the beginning and ending are
deleted; however, a section cannot be cut and pasted in the recording or into another
recording. When editing is completed, the file can either be saved as a new file or an
overwrite of the original recording.
Any section of the recording including the whole recording can be recorded over
and it can either be saved as a new recording or an overwrite of the original recording.
Like the original recording, any recording, even a partial overwrite, can be done in any
format; it does not have to be the same as the original recording. If the recording is
overwritten, the original no longer exists. If a recording is deleted, it disappears from the
23
app. (It is unknown whether the phone retains the audio recording or not, that was outside
the scope of this paper.)
Interrupted Recordings with Phone Calls
Since the S9 had service at the time of testing, recordings were made with an
interruption of an incoming call from another mobile phone. The first recording received a
phone call, but the call was ignored. The Voice Recording did not pause or stop if the phone
call was ignored; however, a vibrating noise is recorded in the audio.
Another recording was made with an interrupting phone call and this time the call
was answered. The Voice Recorder paused the recording as soon as the call was answered
and then resumed automatically once the call ended. It did not record any of the
conversation.
24
CHAPTER III
TEST RECORDING PROTOCOL
A testing protocol, developed by Jeff Smith, et al. for the iOS in “Triage Approach for
the Forensic Analysis of Apple iOS Audio Files Recorded Using the ‘Voice Memos’ App” [4]
was later expanded by Hill for his thesis, “Analysis of Audio Recordings made using ‘Voice
Memos’ application for iOS” [5]. Hill’s thesis protocol offered a skeleton of protocols to
start with; but since the Android OS and the iOS are very different in form and function, a
proper protocol had to be created for the Android OS. Since the HTC One had such limited
capabilities, a protocol was not established; and since the S6 and S9 were identical in
abilities, those two phones were combined to create the protocol for those Android
versions.
LG Q6
Since this version of the Voice Recorder offered options for recording and editing, it
was important to ensure that all recording options as well as editing options were
explored; therefore, a testing protocol was established. It was important to see what
artifacts were introduced into the recording by Android when the user accesses all
available options for recording and editing.
In view of the fact that there was only one quality setting for the audio, different
recordings were completed as continuous or paused and either saved on the device or on
the external storage card. The editing section allows the user to trim the beginning, ending
or both for whatever desired amount of time. Additional recordings were created and then
later edited and saved as overwritten recordings. All original, edited and overwritten
recordings were transferred to the computer using a USB cable.
25
Samsung S6 and S9
As previously stated in Chapter 2, the S6 and S9 had three quality settings all of
which could be done in mono or stereo: low quality, mid quality and high quality; therefore,
each set of recordings had to be completed in each quality setting, including all edited
recordings. Like the Q6, continuous and paused recordings were created. A protocol was
created to “stop” and “save” immediately after recording and “stop” is pressed and “save” is
pressed one minute later. Later, original recordings were changed by recording over a
portion of the recording and then saved as an overwritten file. Recordings were also
trimmed from the beginning, end, both, and deleted sections of the middle of the
recordings. Each edit was done on each quality setting.
The S9 had service during the testing period so recordings were made with
interruptions from incoming calls as well. One protocol was to ignore the call, the other
protocol was to answer the call.
All recordings from the S6 and the S9 were transferred to the computer using a USB
and USB-C cable respectively.
26
CHAPTER IV
RESULTS
All phones except for the HTC One - complied to the QuickTime File Format
Specification [7]. Figure 23 is an example of a movie atom structure showing the
breakdown of the moov atom and what order the atoms are in. Each voice recording -
again with the exception of the HTC One followed this structure.
Figure 23: QuickTime File Format Movie Atom Example
27
While the S6 and S9 were almost exactly the same in Voice Recorder app and all the
features that it offered, when it came to the results that were found, they actually differed
on a few things. Therefore, each phone will be listed separately with the results that were
found.
Device #1: HTC One
The HTC One revealed a minimal amount of results. One key factor noted from the
very beginning was the inability to edit directly on the app. The encoding of the audio is
also limited to AMR-NB, AMR-WB and AAC-LC. It is possible to take a recording from the
phone, download it to the computer and then edit it from a third-party editor. As long as
the new audio file is saved as an AAC, it is possible to then upload the audio recording back
onto the app. For this paper the editing was done in Adobe Audition [8] and saved as AAC.
(Any other format was not able to upload and be accessible in the app on the phone.) This
new recording was then downloaded from the computer into the Voice Recorder folder on
the phone. On the user interface there was no visible difference between this new edited
recording and the other original recordings.
When the edited recording was downloaded back onto the app, there was no visible
difference between that one and others that were directly recorded on the phone (Figure
24). The date displayed is the date that the audio was downloaded onto the phone from
the computer after it had been edited in Adobe Audition. In the list of recordings, it is listed
at the top since it was the most recent recording, but there is nothing else visually that sets
it apart from any of the other recordings.
28
Figure 24: Edited Audio in Voice Recorder
The recordings on this device also contained a minimal amount of metadata. When
looked at through a hex editor like 010 Editor [9], most of the data was raw audio data,
including the AAC recordings (Figure 25, Figure 26, Figure 27). Therefore, there was no
atom structure to examine.
Figure 25: AMR-NB Hex Data
Figure 26: AMR-WB Hex Data
29
Figure 27: AAC Hex Data
However, the atom structure for the recording edited in Adobe Audition and then
downloaded back into the app, gave very different information. The header and footer
information viewed in a hex editor revealed all the information of the file from Adobe and
how it was saved as a file. This atom structure followed the QuickTime File Format and
immediately the header of the file gave different metadata from the original recording
(Figure 28).
30
Figure 28: Header Information in Hex Editor
In the footer information of the hex, Adobe Audition is specifically listed (Figure
29). It also shows that the file was from a Windows version of Audition. Since this hex
information varies so much from an original recording on the HTC One, an examiner can
easily assess that this recording cannot be original to the phone.
Figure 29: Footer Information
Device #2: LG Q6
Consistencies and Inconsistencies
Following the testing protocol, it was important to see what information is
consistent and inconsistent across the different types of recordings. All bit rates and
sample rates remained the same regardless of whether the recording was continuous,
paused, edited or overwritten. The Android version 7.1.1 and the phone model number
LG-US700 - were also listed in the header and footer of the metadata, depending on
whether it was an unedited or edited recording. For all continuous or paused unedited
recordings the metadata was contained in the header of the file. For edited or overwritten
continuous or paused recordings, the metadata was contained in the footer of the file.
31
Atom Structure
For unedited recordings, the metadata is contained in the header and the media data
(mdat) atom is at offset 0x62E9F. This was consistent for all unedited recordings, whether
continuous or paused. However, for continuous/paused edited/overwritten recordings the
metadata is contained in the footer and the mdat atom is at offset 0xC97. This structure
change shows that something is different between the unedited and edited/overwritten
recordings. Also, in edited and overwritten recordings a “free” atom is contained in the
header. This is another indication that something has changed from an unedited recording.
Table 3: Comparison of Unedited and Edited Recordings on the Q6
LG Q6
UNEDITED
EDITED/
OVERWRITTEN
RESULTS
BITE RATE
96 kbps
96 kbps
CONSISTENT
SAMPLE RATE
44.1 kHz
44.1 kHz
CONSISTENT
ANDROID VERSION
LISTED
LISTED
CONSISTENT
"PHONE MODEL"
LISTED
LISTED
CONSISTENT
MDAT ATOM AT OFFSET
0x62E9F
0xC97
INCONSISTENT
METADATA LOCATION
HEADER
FOOTER
INCONSISTENT
HEADER OF FILE
METADATA
"FREE"
INCONSISTENT
Device #3: Samsung S6
Consistencies and Inconsistencies
There were many similarities between the unedited and edited recordings,
regardless of whether they were continuous or paused recordings. The sample rate and bit
rate remained the same and there was no “Android app” listed and no Voice Recorder”
listed in the metadata.
32
However, in unedited recordings the Android version is listed in the metadata but
not in the edited versions. This was true for continuous and paused recordings, regardless
of whether the recordings were edited or overwritten.
Atom Structure
The mdat atom was located at offset 0x1C for both edited and unedited recordings,
and all metadata was contained in the footer. The headers of the files were also very
different at first glance. Figure 30 displays how the header of an unedited recording
contains some basic file information: file type, iso_media file format, and the mdat atom
followed by many repeated bytes, i.e., 0x2D, 0x5A, 0xB4.
Figure 30: Hex Data Header of Unedited Recording
While Figure 31 displays how the header of an edited recording also contains the
file type, iso_media file format and mdat atom, this information is followed by raw audio
data.
33
Figure 31: Hex Data Header of Edited Recording
So even though there are many consistencies between the unedited and edited
recordings, there are differences between the two as shown in Table 4.
Table 4: Comparison of Unedited and Edited Recordings on the S6
SAMSUNG S6
UNEDITED
EDITED/
OVERWRITTEN
RESULTS
BITE RATE
USER
DETERMINED
SAME CONSISTENT
SAMPLE RATE
USER
DETERMINED
SAME CONSISTENT
"ANDROID APP"
NOT LISTED
NOT LISTED
CONSISTENT
"VOICE RECORDER"
NOT LISTED
NOT LISTED
CONSISTENT
MDAT ATOM AT OFFSET
0x1C
0x1C
CONSISTENT
METADATA LOCATION
FOOTER
FOOTER
CONSISTENT
ANDROID VERSION
LISTED
NOT LISTED
INCONSISTENT
HEADER OF FILE
METADATA &
REPEATED
RAW AUDIO
BYTES
METADATA &
RANDOM RAW
AUDIO BYTES
INCONSISTENT
34
Device #4: Samsung S9
Consistencies and Inconsistencies
As stated earlier, the S6 and S9 were very similar but the results differed a bit. On
the S9, “Android app” and “Voice Recorder” were listed in the metadata of the file. This is
where the S6 and S9 differed. The S6 did not list “Android app” orVoice Recorder” while
the S9 did. This was the only area where they were different. Even though the Android
versions are different and the Voice Recorder versions are different, the user interface is
the same. So, to find something that was different in the metadata between the two was
unexpected.
On the S9 the bit rate and sample rate remained the same regardless of whether the
recording was continuous or paused, edited or unedited. The “Android app” and “Voice
Recorder” were also listed in both unedited and edited recordings.
One difference observed between the unedited and edited recordings was that the
Android version is listed in the metadata for the unedited recordings, while the Android
version is not listed in the edited or overwritten recordings.
Atom Structure
For both unedited and edited/overwritten recordings, the mdat atom is
located at offset 0x1C. The metadata for both is also included in the footer of the file;
however, like the S6, the header information is different between unedited and
edited/overwritten recordings. Consistent with the S6, the header of an unedited
recording contains some basic file information, file type, iso_media file format, and the
mdat atom followed by many repeated bytes, i.e., 0x2D, 0x5A and 0xB4. The header for an
edited/overwritten recording contains the file type, iso_media file format and mdat atom,
35
and then this information is followed by raw audio data. Table 5 summarizes the
consistencies and inconsistencies between the unedited and edited/overwritten
recordings. Again, whether the recording was continuous or paused, the atom structure
remains the same.
Table 5: Comparison of Unedited and Edited Recordings on the S9
SAMSUNG S9
UNEDITED
EDITED/
OVERWRITTEN
RESULTS
BITE RATE
USER
DETERMINED
SAME CONSISTENT
SAMPLE RATE
USER
DETERMINED
SAME CONSISTENT
"ANDROID APP"
LISTED
LISTED
CONSISTENT
"VOICE RECORDER"
LISTED
LISTED
CONSISTENT
MDAT ATOM AT OFFSET
0x1C
0x1C
CONSISTENT
METADATA LOCATION
FOOTER
FOOTER
CONSISTENT
ANDROID VERSION
LISTED
NOT LISTED
INCONSISTENT
HEADER OF FILE
METADATA &
REPEATED
AUDIO BYTES
METADATA &
RAW AUDIO
BYTES
INCONSISTENT
36
CHAPTER V
CONCLUSION
Each phone with its different Android versions and different app versions offered
different results based upon whether the recording was edited or unedited, continuous or
paused. All of which contain important information when it comes to the analysis of these
recordings and the authenticity of these recordings as related to each phone. Given that
each phone comprises different user interfaces and different results, it’s important for
investigators to be aware of the features and limitations for each app. The consistencies
between edited and unedited recordings also supply examiners with much needed
information. There are many other aspects of the Voice Recorder app to research, but this
paper provides a plethora of information that was not available before.
Future Research
There are many phones on the market that need to be tested. Motorola and Nokia
phones do not have a default voice recorder app, but they are different versions of Android
and can have different artifacts than the phones tested for this paper. There are also many
third-party voice recorders available from Google Play that also may have different
artifacts from the apps tested for this paper. All of them need research. The speech-to-text
option on the Voice Recorder app for the Samsung phones also needs research. The dates
and times of the recordings need to be thoroughly investigated on each phone as well.
Different devices, such as tablets, also have the capability to record audio. The
Memo’sapplication that comes on Android phones and tablets also has the ability to
record audio. There may be enough similarities between them all that further research is
not necessary, but this is unknown at this time.
37
The Android OS, like the iOS, will always be updating with new features and
abilities. The Voice Recorder app will also go through updating and possibly a total refresh
to the app. These new developments will need to be studied.
There are also audio recording apps available that can record a phone call. These,
too, need research. It is important to keep in mind with this type of recording that state
laws are taken into consideration. In some states only one party needs to be aware that the
conversation is being recorded, while others require that both parties know and consent to
having the conversation recorded.
38
REFERENCES
1. Callaham, J. The History of Android OS: its name, origin and more. 2019 August 18,
2019 [cited 2019 August 18, 2019]; Available from:
https://www.androidauthority.com/history-android-os-name-789433/.
2. O'Dea, S. Android OS market share of smartphone sales to end users from 2009-2018.
2020 Feb. 28, 2020; Available from:
https://www.statista.com/statistics/216420/global-market-share-forecast-of-
smartphone-operating-systems/.
3. Hoog, A., Android Forensics. 2011: Syngress.
4. Smith, J., et al., Triage Approach for the Forensic Analysis of Apple iOS Audio Files
Recorded Using the "Voice Memos" App, in 2017 International Conference on Audio
Forensics. 2017, AES: Arlington, VA. p. 1-5.
5. Hill, A., ANALYSIS OF AUDIO RECORDINGS MADE USING “VOICE MEMOS”
APPLICATION FOR iOS, in College of Arts and Media. 2017, University of Colorado
Denver: National Center for Media Forensics.
6. Scientific Working Group on Digital Evidence, SWGDE Digital and Multimedia
Evidence Glossary. 2016 6/23/2016 9/13/2019]; Available from:
https://www.swgde.org/documents/Current%20Documents/SWGDE%20Digital%
20and%20Multimedia%20Evidence%20Glossary.
7. QuickTIme File Format Specification. 2016 9-12-2016 Feb. 15, 2019]; Available from:
https://developer.apple.com/library/archive/documentation/QuickTime/QTFF/Q
TFFPreface/qtffPreface.html.
8. Adobe, Adobe Audition. adobe.com.
9. 010 Editor. Sweetscape Software.
39
APPENDIX A
TEST RECORDING COLLECTION PROTOCOL FOR LG Q6
PROPOSED LG Q6 "AUDIO RECORDER"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH Q6, OS 7.1.1, APP VERSION 6.1.8]
STATE
#
DESCRIPTION
EXPECTED OUTCOME
REASON(S)
Continuous
1
Continuous 1-minute recording with "stop" pressed as quickly as possible at the
end of the recording; saved with default name.
96 kbps, 44.1kHz
mono
MPEG 4
Time
characteristics
of stop/pause
events
2
3
4
Continuous 1-minute recording with "stop" pressed as quickly as possible at the
end of the recording; saved with default name. (These will be overwritten in
editing).
5
6
Discontinuous
7
1-minute recording, press "pause" and leave for 2-minutes; press "record" and
leave for one additional minute then "stop" to end recording; save with default
name.
8
9
10
1-minute recording, press "pause" and leave for 2-minutes; press "record" and
leave for one additional minute then "stop" to end recording; save with default
name. (These will be overwritten in editing).
11
12
DOWNLOAD TEST RECORDINGS 1 → 12
40
PROPOSED LG Q6 "AUDIO RECORDER"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH Q6, OS 7.1.1, APP VERSION 6.1.8]
STATE
#
DESCRIPTION
EXPECTED OUTCOME
REASON(S)
Altered (new file)
13
At least one day after the initial test recording of one continuous minute,
click the scissors icon (editing) and move start point to 20-second point so
that the recording length is now approx. 40 seconds (deleting the first 20
seconds of the recording). Then click on check icon. Select to save as new file
(not overwrite the original recording), save with default name.
96 kbps, 44.1kHz
mono
MPEG 4
Metadata/file
structure,
evidence of
editing
14
At least one day after the initial test recording of one continuous minute,
click the scissors icon (editing) and move end point to 20-seconds so that the
recording length is now approx. 40 seconds (deleting the last 20 seconds of
the recording). Then click on check icon. Select to save as new file (not
overwrite the original recording), save with default name.
15
At least one day after the initial test recording of one continuous minute,
click the scissors icon (editing) and move start point to 20-seconds and end
point to 40-seconds so that the recording length is now approx. 20 seconds
(deleting the first 20 seconds and the last 20 seconds of the recording). Then
click on check icon. Select to save as new file (not overwrite the original
recording), save with default name.
41
PROPOSED LG Q6 "AUDIO RECORDER"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH Q6, OS 7.1.1, APP VERSION 6.1.8]
STATE
#
DESCRIPTION
EXPECTED OUTCOME
REASON(S)
Altered and Discontinuous (new file)
16
At least one day after the initial test recording of discontinuous minutes, click
the scissors icon (editing) and move start point to 20-second point so that the
recording length is now approx. 1 minute, 40 seconds (deleting the first 20
seconds of the recording). Then click on check icon. Select to save as new file
(not overwrite the original recording), save with default name.
96 kbps, 44.1kHz
mono
MPEG 4
Metadata/file
structure,
evidence of
editing
17
At least one day after the initial test recording of discontinuous minutes, click
the scissors icon (editing) and move end point to 20-seconds so that the
recording length is now approx. 1 minute 40 seconds (deleting the last 20
seconds of the recording). Then click on check icon. Select to save as new file
(not overwrite the original recording), save with default name.
18
At least one day after the initial test recording of discontinuous minutes, click
the scissors icon (editing) and move start point to 20-seconds and end point to
20 seconds so that the recording length is now approx. one minute 40 seconds
(deleting the first 20 seconds and the last 20 seconds of the recording). Then
click on check icon. Select to save as new file (not overwrite the original
recording), save with default name.
42
PROPOSED LG Q6 "AUDIO RECORDER"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH Q6, OS 7.1.1, APP VERSION 6.1.8]
STATE
#
DESCRIPTION
EXPECTED OUTCOME
REASON(S)
Overwrite
continuous
19
Continuous 1-minute recording with "stop" pressed as quickly as possible at
the end of the recording (original), edit recording and choose "overwrite"
option and give new name.
96 kbps, 44.1kHz
mono
MPEG 4
Metadata/file
structure,
evidence of
editing
20
Overwrite
discontinuous
21
1-minute recording, press "pause" and leave for 2-minutes; press "record" and
leave for one additional minute then "stop" to end recording (original), edit
recording and choose "overwrite" option and give new name.
96 kbps, 44.1kHz
mono
MPEG 4
Metadata/file
structure,
evidence of
editing
22
DOWNLOAD TEST RECORDINGS 13 → 22
43
APPENDIX B
TEST RECORDING COLLECTION PROTOCOL FOR SAMSUNG S6 AND S9
PROPOSED SAMSUNG S6 AND S9 "VOICE RECORDER"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH S6 & S9
ANDROID 7 & 10, APP VERSIONS 20.1.83-16, 21.2.00.42]
STATE
#
SETTINGS
DESCRIPTION
EXPECTED
OUTCOME
REASON(S)
Continuous
1→2
Low quality - 64 kbps, 44.1kHz,
mono & stereo
Continuous 1-minute recording with
"stop" and "save" pressed as quickly
as possible at the end of the
recording; saved with default name.
(Additional recordings created for
overwrite option).
consistent quality
settings for each
recording
MAC Information
Time characteristics
of stop/pause
events
metadata for
storage on SD card
3→4
Mid quality - 128kbps, 44.1kHz,
mono & stereo
5→6
High quality - 256kbps, 48kHz,
mono & stereo
7→8
Low quality - 64 kbps, 44.1kHz,
mono & stereo
Continuous 1-minute recording with
"stop" pressed to end the recording,
then "save" pressed one minute later.
(Additional recordings created for
overwrite option). Some recordings
are saved on an external memory
card.
9→10
Mid quality - 128kbps, 44.1kHz,
mono & stereo
11→12
High quality - 256kbps, 48kHz,
mono & stereo
44
PROPOSED SAMSUNG S6 AND S9 "VOICE RECORDER"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH S6 & S9
ANDROID 7 & 10, APP VERSIONS 20.1.83-16, 21.2.00.42]
STATE
#
SETTINGS
DESCRIPTION
EXPECTED
OUTCOME
REASON(S)
Discontinuous
13→14
Low quality - 64 kbps, 44.1kHz,
mono & stereo
1-minute recording, press "pause"
and leave for 2-minutes; press
"record" and leave for one additional
minute then "stop" to end recording;
save with default name. (Additional
recordings created for overwrite
option). Some recordings are saved
on an external memory card.
consistent quality
settings for each
recording
MAC Information
Time characteristics
of stop/pause
events
metadata for storage
on SD card
15→16
Mid quality - 128kbps, 44.1kHz,
mono & stereo
17→18
High quality - 256kbps, 48kHz,
mono & stereo
19→20
Low quality - 64 kbps, 44.1kHz,
mono & stereo
1-minute recording, press "pause"
and leave for 2-minutes; press
"record" and leave for one additional
minute then "stop" to end recording;
press "save" one minute later with
default name. (Additional recordings
created for overwrite option). Some
recordings are saved on an external
memory card.
21→22
Mid quality - 128kbps, 44.1kHz,
mono & stereo
23→24
High quality - 256kbps, 48kHz,
mono & stereo
25
Mid quality - 128kbps, 44.1kHz,
stereo
Continuous recording, received
incoming call, but did not answer (let it
go to voicemail), pressed "stop” and
"save" at the end of the recording
26
High quality - 256kbps, 48kHz,
stereo
Continuous recording, received
incoming call, answered (noted call
duration), pressed "stop” and "save" at
the end of the recording
DOWNLOAD TEST RECORDINGS 1 → 26
45
PROPOSED SAMSUNG S6 AND S9 "VOICE RECORDER"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH S6 & S9
ANDROID 7 & 10, APP VERSIONS 20.1.83-16, 21.2.00.42]
STATE
#
SETTINGS
DESCRIPTION
EXPECTED
OUTCOME
REASON(S)
Altered continuous (new file)
27→33
Low quality - mono & stereo
Mid quality - mono & stereo
High quality - mono & stereo
At least one day after the initial test recording
of one continuous minute, click on "edit" and
move start point to 20-second point so that the
recording length is now approx. 40 seconds
(deleting the first 20 seconds of the recording).
Then click on scissors icon and select "delete
dimmed area". Select to save as new file (not
overwrite the original recording), save with
default name.
consistent
quality settings
for each
recording
evidence of
editing
MAC Information
Metadata/file
structure, evidence
of editing
34→40
Low quality - mono & stereo
Mid quality - mono & stereo
High quality - mono & stereo
At least one day after the initial test recording
of one continuous minute, click the scissors icon
(editing) and moved end point to 20-seconds so
that the recording length is now approx. 40
seconds (deleting the last 20 seconds of the
recording). Then click on check icon. Select to
save as new file (not overwrite the original
recording), save with default name.
41→47
Low quality - mono & stereo
Mid quality - mono & stereo
High quality - mono & stereo
At least one day after the initial test recording
of one continuous minute, click the scissors icon
(editing) and move start point to 20-seconds
and end point to 40-seconds so that the
recording length is now approx. 20 seconds
(deleting the first 20 seconds and the last 20
seconds of the recording). Then click on check
icon. Select to save as new file (not overwrite
the original recording), save with default name.
46
PROPOSED SAMSUNG S6 AND S9 "VOICE RECORDER"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH S6 & S9
ANDROID 7 & 10, APP VERSIONS 20.1.83-16, 21.2.00.42]
STATE
#
SETTINGS
DESCRIPTION
EXPECTED
OUTCOME
REASON(S)
Altered and Discontinuous (new file)
48→54
Low quality - mono & stereo
Mid quality - mono & stereo
High quality - mono & stereo
At least one day after the initial test recording of
discontinuous minutes, click the scissors icon
(editing) and move start point to 20-second point
so that the recording length is now approx. 1
minute, 40 seconds (deleting the first 20 seconds
of the recording). Then click on check icon. Select
to save as new file (not overwrite the original
recording), save with default name.
consistent quality
settings for each
recording
evidence of editing
MAC Information
Metadata/file
structure, evidence
of editing
55→61
Low quality - mono & stereo
Mid quality - mono & stereo
High quality - mono & stereo
At least one day after the initial test recording of
discontinuous minutes, click the scissors icon
(editing) and move end point to 20-seconds so
that the recording length is now approx. 1 minute
40 seconds (deleting the last 20 seconds of the
recording). Then click on check icon. Select to
save as new file (not overwrite the original
recording), save with default name.
62→68
Low quality - mono & stereo
Mid quality - mono & stereo
High quality - mono & stereo
At least one day after the initial test recording of
discontinuous minutes, click the scissors icon
(editing) and move start point to 20-seconds and
end point to 20 seconds so that the recording
length is now approx. one minute 40 seconds
(deleting the first 20 seconds and the last 20
seconds of the recording). Then click on check
icon. Select to save as new file (not overwrite the
original recording), save with default name.
47
PROPOSED SAMSUNG S6 AND S9 "VOICE RECORDER"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH S6 & S9
ANDROID 7 & 10, APP VERSIONS 20.1.83-16, 21.2.00.42]
STATE
#
SETTINGS
DESCRIPTION
EXPECTED
OUTCOME
REASON(S)
Continuous
Overwrite file
6975
Low quality - mono & stereo
Mid quality - mono & stereo
High quality - mono & stereo
At least one day after the initial test recording of
one continuous minute, select "edit" then "record"
for 30 seconds, then "pause" to stop the new
recording. Select "save" then select "replace
original file".
consistent quality
settings for each
recording
MAC Information
Metadata/file
structure,
evidence of
overwriting
Discontinuous
Overwrite file
7682
Low quality - mono & stereo
Mid quality - mono & stereo
High quality - mono & stereo
At least one day after the initial test recording of
one continuous minute, select "edit" then "record"
for 30 seconds, then "pause" to stop the new
recording. Select "save" then select "replace
original file".
DOWNLOAD ALTERED RECORDINGS 27→ 82