Original, device and methodology: how digital evidence is verified

To verify the authenticity of an audio or video recording or a digital image, an expert needs information about the file’s origin, how it was created, and, if possible, the original medium and the corresponding device. Without this information, the scope of the investigation may be limited.

The handling of such evidence was discussed during the roundtable «Digital forensics and forensic expertise: challenges of the digital evidence era», organized by the UNBA Committee on expert support for legal practice and the UNBA Committee on criminal law and procedure.

The discussion was moderated by the chairmen of these Committees Violetta Fedchyshyn and Anzhelika Moiseyeva. They focused the discussion on practical issues faced by advocates: how to properly formulate a task for an expert, verify conflicting conclusions, and assess the reliability of methods for identifying materials created using artificial intelligence.

Today, digital audio recordings can be altered using readily available software. This was pointed out by Yuriy Kharabuga, a senior research fellow at the Laboratory for Research on Information Technology and Intellectual Property at the Lviv Research Institute of Forensic Expertise. The forensic expert noted that individual phrases can be cut out, placed in a different context, or generated using a specific person’s voice. Therefore, the defense should request the original recording that is proposed to be used as evidence.

According to him, advocates often include standard questions from methodological guidelines in their motions without taking into account the circumstances of the specific case. Therefore, before ordering an expert examination, it is advisable to consult with an expert regarding the appropriateness of the questions and the materials required for the examination.

During the discussion, Y. Kharabuga also cautioned against equating an exact digital copy with a re-recording. If the original file was converted to another format, changes could have been made to it afterward. Therefore, it is necessary to determine in which format the recording was created, how it was transferred to another medium, and whether there is confirmation that the data has not been altered.

Olga Brendel, head of the Sector for Computer-Technical, Telecommunications and Audio-Video Recording Research at the M. S. Bokarius Institute of Forensic Expertise, explained that a copy can be the subject of an investigation when its identity with the original is confirmed both documentarily and technically. For digital files, this can be established by comparing checksums: if no changes have been made, they will match.

To determine on which device a recording was created, the file itself is not sufficient. The expert must be provided with the relevant equipment, as well as information regarding any repairs, replacement of individual components, or other technical modifications made after the recording was created. Such circumstances may affect the characteristics of the experimental samples against which the material under examination will be compared.

Separately, O. Brendel emphasized that an expert does not have the right to independently collect or request the objects of the examination. The party initiating the examination must ensure that the materials are provided.

During a voice analysis, an advocate also cannot independently confirm that a comparative sample belongs to a specific individual. In the absence of confirmation from the investigation or the court, the question can be formulated as determining whether the voices on the two recordings belong to the same person, without specifying that person’s last name, first name, and patronymic. [35:42–37:47]

Yevhen Syvokon, who represented the Video and Audio Recording Research Department of the Research Center for Independent Forensic Expertise of the Ministry of Justice of Ukraine, noted that technical alterations to a file do not always indicate forgery. Recoding can occur automatically during export from a video surveillance system or when sent via a messaging app, and the absence of metadata does not in itself confirm forgery. One should evaluate the totality of the identified characteristics and their interrelationships.

The spread of deepfakes creates two opposing problems: synthetic material can be presented as genuine, while an authentic recording can be called into question simply because of the technical possibility of faking it. Therefore, the mere existence of the relevant technology does not prove the artificial origin of a specific file. To reach a conclusion, an expert must examine the characteristics present specifically in the material provided.

Current scientific and methodological guidelines do not specifically define the task of identifying indicators of a synthetic voice. Such an investigation requires a comprehensive analysis of the digital file’s structure, acoustic and spectral characteristics, and—where relevant—linguistic features of speech.

Yevhen Tymko, head of the Digital Evidence Research Laboratory at the Kyiv Research Institute of Forensic Expertise, outlined the limitations of current forensic analysis of materials created using artificial intelligence. He explained that during international testing to detect deepfakes in images, the results were generally about 50-50. Artificial intelligence models trained to recognize such images demonstrated the best performance. At the same time, the use of such systems in forensic analysis is complicated by the fact that the algorithm operates as a «black box» and the expert cannot fully explain how the result was obtained.

According to him, scientific literature describes methods for detecting materials created using artificial intelligence; however, there are currently no formalized and validated expert methodologies. Validation must confirm the scientific validity of the method, and the conclusion must clearly define the limits of its application.

Y. Tymko also highlighted the need for expert opinions to be presented in a clear and understandable manner. Complex technical provisions must be explained in a way that a layperson without specialized knowledge can understand. If there are multiple expert opinions with differing results, it is advisable to summon the expert to court, where the parties can ask questions regarding the research conducted, the methods used, and the conclusions drawn.

During the roundtable, it was also reported that the Ministry of Justice is working on standardizing expert specialties and finalizing scientific and methodological recommendations. These recommendations should define typical questions, subjects, and objects of investigation, as well as requirements for the materials needed to perform specific expert tasks.