Greetings,
I wonder if anyone has done some work determining whether audio recorded on an iPhone has been edited/modified/tampered with on the device following the original recording, or on the device during the recording (such as by pausing and then continuing the recording).
I have a file which is suspected of not representing the original conversation. The file modified date/time stamp is correct. I suspect the only way would be for the recording to be paused and then restarted on the device during the conversation.
I worked on a case similar to this a few months back, although it was on Android.
If you have both the file created and file modified timestamps, you can check whether the timegap between them and the duration of the audio recording is almost same or not. The file created timestamp is written when the file was first created i.e. the time recording started. The file modified timestamp is updated when the file was finally written to the disk. That is the time when recording likely stopped. If the time gap is larger than the recording length, then there is a possibility of tampering as you have mentioned.
Anyway this was the case which I had encountered. Please test it out to be sure.
Hello,
A couple of suggestions and thoughts
1) iCloud and iTunes mobile backups
Acquire workstation based and cloud based mobile backups of the phone in question and compare the recording evidence across multiple sources.
For example, one might find an iCloud backup created months prior that shows more or different evidence than what is stored on the current physical phone.
If an iCloud or iTunes mobile backup of the physical phone created six months ago reveals the exact same time stamps for the audio file in question, then one could infer that, if tampering or spoliation did in fact occur, it occurred PRIOR to the date the mobile backup was made.
2) Time metadata fields in iOS versus Windows
I believe that iOS time stamp metadata values such as Modified Time and Change Time follow the Linux convention and not the Windows convention.
Windows system Creation Time does show the time a given file was first created on a volume, but Linux's Change Time can also represent the time a given file grows or shrinks significantly.
So, I would be careful making inferences about metadata time values without an understanding of what the values actually mean and track.
To the extent possible, build a timeline of metadata and activities on the phone around the time of alleged "spoliation".
Most times when faced with disproving a negative, I have to prove what DID actually occur for a given time period.
3) Program logs
Some times applications store information related to user activities in "log" files, usually a .LOG file. You may find a log file for your particular application that tracks a user starting, pausing and otherwise interacting with the application itself.
Regards,
Larry