Was this audio recording edited?

An edit is a join, and a join is a place where two things that were never next to each other have been put together. Four traces tend to survive that, and you can measure all four: a step in the waveform, a change in the background noise, a jump in DC offset, and runs of exactly zero samples. SPLICE measures them and gives you timestamps to listen to, in the browser, with nothing uploaded. What it will not do is tell you a recording was edited, and neither will anything else — the honest output is a shorter list of places to put your ears.

The four things a cut leaves behind

• A step in the waveform. Audio is a line, and a cut made anywhere other than a zero crossing leaves a vertical jump in it. Compared against the median difference in the fifty milliseconds either side, a genuine join stands out by an order of magnitude.
• A change in the background. Every room has a tone — ventilation, traffic, the noise floor of the microphone itself. Two recordings joined together rarely share one, and a step of six decibels or more in the quiet floor is a change of room, of microphone, or of session.
• A jump in DC offset. Different hardware sits at a slightly different electrical zero, and the offset does not change on its own part-way through a take.
• Runs of exact digital silence. A microphone in a real room never produces samples of precisely zero. Software does: muting, a removed passage, a gap left by a joining tool.

Why finding nothing proves nothing

This is the part that is missing almost everywhere, and it matters more than the list above.

All four traces are destroyed by a lossy re-encode. Anything that has been through MP3, AAC or a messaging app has been rebuilt from a frequency representation that does not preserve sample-to-sample steps at all, and the encoder smooths precisely the discontinuities this looks for. A crossfade of five milliseconds — the default in every editor on the market, applied without anybody choosing it — hides a join completely and costs the person making it nothing.

So a recording that was cut carefully and exported as MP3 can leave nothing to find. “No indicators” means the file does not carry these particular traces. It does not mean the recording is unedited, and it should never be written up as though it does.

Why finding something is not proof either

The same measurements come out of things nobody edited. A door closing. A microphone knocked. A peak that clipped. A buffer dropped by the recording software. An automatic gain control deciding to change the level mid-sentence. Digital silence appears wherever a device muted itself, which phones do constantly.

Which is why the output is timestamps rather than a verdict. An hour of audio is an hour of listening; a list of a dozen timestamps is a few minutes. Play each one, decide what you are hearing, and let the conclusion come from the audio rather than from the chart.

What to do before you examine anything

1. Get the original. The file as the device wrote it, before anything re-encoded it. A copy that arrived over a chat app has already been through the process that erases the evidence, and no amount of analysis recovers it. If the original exists, ask for it in those words.
2. Record what you received, before you open it. PROVENANCE takes a SHA-256 with a note of where it came from and when, so the copy you analysed can be shown later to be the copy you were given. That is the first question asked of any examination and the one people most often cannot answer.
3. Work on a copy. Opening a file in an editor can rewrite it. Keep the original untouched.
4. Note what the file says about itself. Container, codec, sample rate, duration and the metadata: a recording whose codec is not the one that device produces has been through something.

Where this sits against the alternatives

Page one of any search for this gives you two answers. Import it into an editor and look at the waveform, which is real advice and is also a person eyeballing an hour of audio at a resolution where a five-millisecond join is one pixel. Or engage a forensic examiner, which is the right answer when a recording is going to be relied on in a proceeding and is not the right answer for finding out whether it is worth pursuing at all.

This is the step in between: the measurements a person would make by eye, made by arithmetic, in a few seconds, on your own machine. It narrows an hour to a handful of places. Whether what is there matters is still yours to judge, and if it does matter, an examiner starting from a short list is cheaper than one starting from an hour.

Nothing is uploaded, which for a recording that might be evidence is not a preference. Alongside: TAMPER does the equivalent for a photograph, X-RAY shows what is really inside the container, CHAIN records who held the material and when, and SCRIBE transcribes it on the device if what you need is the words.