NEDERLANDSFORENSISCHINSTITUUT

Nederlands Forensisch Instituut Laan van Ypenburg 6, 2497 GB Den Haag

Determination of time of recording with Electric Network Frequency (ENF)

M.P. Huijbregtse BS, Zeno Geradts PhDAAFS Denver 2009

NEDERLANDSFORENSISCHINSTITUUT

2/25

Outline

• Introduction ENF • Implications• Research• Conclusions

NEDERLANDSFORENSISCHINSTITUUT

3/25

Introduction

Electricity network• Alternating current • Frequency

• Europe 50 Hz • United States 60 Hz

Introduction Implications Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

4/25

Introduction

Introduction Implication Research Conclusions

ENF pattern

NEDERLANDSFORENSISCHINSTITUUT

5/25

Introduction – prior research• C. Grigoras, Digital audio recording

analysis – the electric network frequency criterion, International Journal of Speech Language and the Law, vol. 12, no. 1, pp. 63-76 (2005)

• M. Kajstura, A Trawinska, J. Hebestreit, Application of the Electrical Network Frequency (ENF) Criterion – A case of a Digital Recording, Forensic Science International, vol. 155, pp. 165-171 (2005)

• A.J. Cooper, The electric network frequence (ENF) as an aid to authenticating forensic digital audio recordings – an automated approach, Conference paper, AES 33rd International Conference, USA (2008)

Introduction Implication Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

6/25

Introduction

Introduction Implication Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

7/25

Introduction

Introduction Implication Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

8/25

Introduction

• Conditions:• ENF pattern is the same in the whole

network• ENF pattern is “unique”• ENF pattern can be filtered from a

recorder

Introduction Implication Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

9/25

Implications – build a database

Introduction Implication Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

10/25

Implications – Build database

Introduction Implication Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

11/25

Implications Build a database

Introduction Implication Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

12/25

Software

• Matlab• Java- applet for collecting,

developed by us : www.sourceforge.net enf collector

Introduction Implication Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

13/25

Software

NEDERLANDSFORENSISCHINSTITUUT

14/25

Implications - filter

• Downsampling naar 300 Hz• Bandpass filteren rond 50 Hz• Spectrogram maken• Piek frequenties bepalen

Introduction Implication Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

15/25

Implications – Filter signalSpectrogram:

Introduction Implication Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

16/25

Implications – filter signal

Introduction Implication Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

17/25

Implications – filter signal

Introduction Implication Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

18/25

Research - Questions

Introduction Implications Research Conclusions

• How unique is an ENF pattern ?• Is it possible to determine the time of

recording ?

NEDERLANDSFORENSISCHINSTITUUT

19/25

Implication

Introductie Praktisch Onderzoek Conclusies

Matching root mean square:

L

nkykxne

L

k

1

2]1[][][

NEDERLANDSFORENSISCHINSTITUUT

20/25

Implication - Uniqueness

Introduction Implications Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

21/25

Implication - Uniqueness

Length ENF pattern (seconds) Limit (Hz)

60 0.0007

120 0.0015

240 0.0020

420 0.0035

600 0.0040

1800 0.0050

3600 0.0080

Introduction Implications Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

22/25

Implication best match• Recording of 3600 seconds:

0.053 Hz < 0.080 Hz

• Recording of 600 seconds:0.047 Hz > 0.040 Hz (!)

• Recording of 60 seconds :0.015 Hz > 0.007 Hz (!)

Introduction Implications Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

23/25

Implication – Best match

Introduction Implications Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

24/25

Implication – Best match

Introduction Implications Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

25/25

Second method

yx

L

k

L

ynkyxkxnr

)1(

)]1[)(][(][ 1

Correlationcoefficiënt:

Introduction Implications Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

26/25

Implication – best match

Introduction Implications Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

27/25

Conclusions• As in literature:

• ENF pattern is the same in the whole network

• ENF pattern can be extracted from network

• Suggestions:• Matching of short recording (< 600

seconds) false hits are possible• Matching with the correlation coefficent

better than root mean square errorIntroduction Implications Research Conclusions

NEDERLANDSFORENSISCHINSTITUUT

28/25

Future research

• Different recorders• (MP3) compression• Improvement of the current

method