Editor’s note: All sounds that humans can hear are called audio. Today, with the high development of Internet technology, various kinds of devices and software emerge in an endless stream, and most of them can transmit and save sound in the form of files, which are called audio files for storing sound.
In the case investigation, if the phone audio files can be directly extracted, such as call recording, phone recording, WeChat voice, QQ voice, etc., it may play a decisive role in the promotion of the case.
Different audio files are encoded in different ways, resulting in different file structures and different data repair methods. When we want to fix these audio files, we need to fix them differently depending on how they are encoded.
PCM coding Introduction
PCM encoding means that PCM signals are not encoded and compressed (lossless compression). Compared with classic signals, it is less susceptible to clutter distortion in the transmission system. The dynamic range is wide and the sound quality is quite good. In computer applications, the highest fidelity level is achieved by PCM coding.
PCM coding application scenario
PCM encoding data is mainly used in WAV audio files.
WAV audio file storage structure and forensic data recovery
- WAV audio file storage structure
WAV audio file of the audio data encoding in PCM, Microsoft ADPCM, IEEE float, ITU g. 711 ɑ – law, ITU g. 711 (including – law, GSM 6.10, ITU g. 721 ADPCM etc. Several common compression formats.
- WAV audio file data recovery
When fixing WAV files, the most critical information is the audio compression encoding format information recorded in the “FMT” block (as shown in the table below). The valid audio data can be extracted from the “data” block according to various encoding methods, and the files can be repaired according to the structure of wav.
| Format code | Format name | fmt Block Length | fact Block |
| 1(0x0001) | PCM/ Uncompressed format | 16 | |
| 2(0x0002 | Microsoft ADPCM | 18 | √ |
| 3(0x0003) | IEEE float | 18 | √ |
| 6(0x0006) | ITU G.711 a-law | 18 | √ |
| 7(0x0007) | ITU G.711 μ-law | 18 | √ |
| 49(0x0031) | GSM 6.10 | 20 | √ |
| 64(0x0040) | ITU G.721 ADPCM | √ | |
| 65,534(0xFFFE) | Encoding format in the subformat block | 40 |
MP3 Coding
Introduction of MP3 coding
Mpeg-1 or MPEG-2 Audio Layer III is an audio compression technology. Its full name is Moving Picture Experts Group Audio Layer III or MP3 for short. It is the most popular audio encoding format at present.
MP3 Coding Application Scenario
MP3 coding data is used in MP3 audio files.
MP3 audio file storage structure and forensic data recovery
An MP3 file is made up of frames, the smallest constituent unit of an MP3 file.
MP3 files are generally divided into three parts: TAG_V2(ID3V2), audio data, TAG_V1(ID3V1)
Each frame of audio data in MP3 audio files is independent of each other, so the length of each frame can be determined according to the frame head structure. Therefore, as long as the parameter information of the frame head structure is obtained, the frame length of each frame can be determined.
MP3 audio file forensic data recovery
Because of the independence between audio frames in MP3 files, the recovery of MP3 audio files determines the audio frame data through the 4-byte frame header of audio frames.
OGG Coding
Introduction of OGG coding
OGG encoding full name is OGGVobis (Ogg Vorbis), which is an audio compression format, similar to MP3 and another music format. But one difference is that it’s completely free, open and patent-free. It also supports multi-channel.
OGG Coding Application Scenario
The audio file format generated by OGG coding is OGG audio file.
OGG audio file storage structure and forensic data recovery
OGG organizes logical flows in pages, each of which has a header and page data section. Each page has the page identifier “OggS” in the header.
In the OGG audio file, the OGG Vorbis bitstream starts with three data packet headers. These header packets are, in order: identify the title, comment title, and set packet. These are closely related to decoding Vorbis audio files, each packet starts with the same header structure “Vorbis”, if an Ogg audio file is missing the contents of any one of the three packets, the audio file will not play properly.
AMR Coding
AMR Coding introduction
AMR is mainly used for the audio of mobile devices. The compression ratio is relatively large, but the quality is relatively poor compared with other compression formats. As it is mostly used for human voice calls.
Payload and Parse modules — decode encoded speech data;
Speech Decode module — decoding Speech frames;
DTX Decode module — Decode noise frame;
Post-processing module — speech post-processing;
AMR coding application scenarios
The audio file format generated by AMR encoding is AMR audio file
AMR audio file forensic data recovery
AMR audio coding is divided into two categories: AMR-NB and AMR-WB. The difference between these two kinds of AMR audio codes mainly lies in the frame type and the corresponding transmission bit rate.
An AMR audio file consists of a file header and several speech frames, the first byte of each speech frame in the frame header of the speech frame, and the byte length of each speech frame is determined according to the frame type value contained in the frame head and the file head structure.
Audio files are used everywhere in our daily work life. As for the various audio formats existing in the market at present, we propose the above several mainstream audio coding principles and the use of these encoding methods of audio file data recovery scheme. Hope to be able to efficiently and quickly solve the problem of audio file data repair.
Conclusion
Thanks for your time reading our blog post, please note that all the technology and solutions mentioned above are already integrated into DRS (Data Recovery System). If you are interested in our forensic solutions, come and check out our website for more information. You can also go to our resource page to download our forensic products for free. We welcome you to contact us and claim your free product trial!
SalvationDATA Blog 