Citation
Analysis of audio recordings made using "voice memos"

Material Information

Title:
Analysis of audio recordings made using "voice memos" application for iOS
Added title page title:
Application for iOS
Creator:
Hill, Andrew Robert ( author )
Place of Publication:
Denver, Colo.
Publisher:
University of Colorado Denver
Publication Date:
Language:
English
Physical Description:
1 electronic file (68 pages) : ;

Thesis/Dissertation Information

Degree:
Master's ( Master of science)
Degree Grantor:
University of Colorado Denver
Degree Divisions:
Department of Music and Entertainment Industry Studies, CU Denver
Degree Disciplines:
Recording arts

Subjects

Subjects / Keywords:
iPhone OS ( lcsh )
iPhone (Smartphone) ( lcsh )
Genre:
bibliography ( marcgt )
theses ( marcgt )
non-fiction ( marcgt )

Notes

Review:
This thesis will discuss the current challenges and previous research done when analyzing audio recordings created by the Voice Memos application for iPhone. An overview of what the Voice Memos application is and the different ways it can create and edit audio recordings will be discussed. How audio files are made and the different aspects of their files and structure will be also be discussed as it relates to the characteristics of Voice Memo recordings. This paper will also expand on and present an updated version of a test recording collection protocol used to collect data from Voice Memos. The new test recording protocol was also used to gather new data from Voice Memos. New findings found from these test recordings will be discussed, as well as new findings in the latest version of iOS. New data will also be used to present an updated Voice Memos recording decision tree, which aims to help quickly analyze audio recordings to see if they're consistent with Voice Memo recordings, and if so, their congruency with an unaltered audio file or one that has been edited or altered with the Voice Memos app.
Bibliography:
Includes bibliographical references.
System Details:
System requirements: Adobe Reader.
Statement of Responsibility:
by Andrew Robert HIll.

Record Information

Source Institution:
University of Colorado Denver
Holding Location:
Auraria Library
Rights Management:
All applicable rights reserved by the source institution and holding location.
Resource Identifier:
on10207 ( NOTIS )
1020700532 ( OCLC )
on1020700532
Classification:
LD1193.A70 2017m H55 ( lcc )

Downloads

This item has the following downloads:


Full Text
ANALYSIS OF AUDIO RECORDINGS MADE USING VOICE MEMOS
APPLICATION FOR iOS by
ANDREW ROBERT HILL B.S., University of Colorado Denver, 2014
A thesis submitted to the Faculty of the Graduate School of the University of Colorado in partial fulfillment of the requirements for the degree of Master of Science Recording Arts Program
2017


2017
ANDREW ROBERT HILL
ALL RIGHTS RESERVED


This thesis for the Master of Science degree by Andrew Robert Hill has been approved for the Recording Arts Program by
Catalin Grigoras, Chair Jeffrey Smith Scott Burgess
December 16, 2017


Hill, Andrew Robert (M.S., Recording Arts Program)
Analysis of Audio Recordings Made Using Voice Memos Application For iOS Thesis directed by Associate Professor Catalin Grigoras
ABSTRACT
This thesis will discuss the current challenges and previous research done when analyzing audio recordings created by the Voice Memos application for iPhone. An overview of what the Voice Memos application is and the different ways it can create and edit audio recordings will be discussed. How audio files are made and the different aspects of their files and structure will be also be discussed as it relates to the characteristics of Voice Memo recordings. This paper will also expand on and present an updated version of a test recording collection protocol used to collect data from Voice Memos. The new test recording protocol was also used to gather new data from Voice Memos. New findings found from these test recordings will be discussed, as well as new findings in the latest version of iOS. New data will also be used to present an updated Voice Memos recording decision tree, which aims to help quickly analyze audio recordings to see if theyre consistent with Voice Memo recordings, and if so, their congruency with an unaltered audio file or one that has been edited or altered with the Voice Memos app.
The form and content of this abstract are approved. I recommend its publication.
Approved: Catalin Grigoras
IV


ACKNOWLEDGEMENTS
I would like to acknowledge my professors Catalin Grigoras and Jeff Smith for all their help with my thesis and all their help throughout my entire graduate education. I would also like to thank Scott Burgess for taking time out of his schedule and agreeing to be my third thesis committee member. Furthermore, I would also like to thank Doug Lacey and Bruce Koenig for their previous research into Voice Memos, which gave my thesis a starting point.
v


TABLE OF CONTENTS
CHAPTER
I. INTRODUCTION...............................................1
Challenges................................................3
Previous Research.........................................4
II. VOICE MEMOS USER INTERFACE................................7
iOS 7....................................................10
iOS 11...................................................12
III. BACKGROUND ON DIGITAL AUDIO............................ 14
Sampling Rate............................................14
Bn Rah:..................................................15
File Formats.............................................16
Atom Structure...........................................17
IV. TEST RECORDING COLLECTION PROTOCOL.......................19
Updates to the Original Test Recording Protocol..........20
V. NEW FINDINGS.............................................24
iOS 11...................................................25
Test Recordings..........................................25
VI. CONCLUSION...............................................29
Future Research..........................................29
REFERENCES...................................................31
vi


APPENDIX
A. TEST RECORDING COLLECTION PROTOCOL IOS 10-11...........33
B. TEST RECORDING COLLECTION PROTOCOL IOS 7...............46
C. TEST RECORDING COLLECTION PROTOCOL IOS 6...............54
D. DECISION TREE..........................................62
E. DECISION TREE IOS 4-6..................................63
F. DECISION TREE IOS 7....................................64
G. DECISION TREE IOS 10...................................65
H. DECISION TREE IOS 11...................................67
vii


LIST OF FIGURES
Figure 1: Voice Memos app icon.....................................................2
Figure 2: Original Voice Memos interface...........................................8
Figure 3: Voice Memos recording....................................................8
Figure 4: Renaming recordings......................................................9
Figure 5: Trimming a recording.....................................................9
Figure 6: New interface in iOS 7..................................................10
Figure 7: Trim editing in iOS 7...................................................12
Figure 8: Different atom types....................................................18
Figure 9: File type atom viewable in metadata.....................................18
Figure 10: How to categorize a file as a Voice Memo in iTunes.....................22
Figure 11: Example of a file hash.................................................22
Figure 12: iOS version in metadata................................................24
viii


CHAPTER I
INTRODUCTION
The iPhone was first introduced on January 9, 2007 and has gone on to sell millions and millions of phones all over the world since its initial release. Just last year (2016), Apple sold almost 212 millions phones worldwide [1], With the popularity and widespread use of iPhones and other smart phones, people now own a device that they can have on them at all times and take with them anywhere. A device that can easily carry out various different tasks such as taking pictures, making phone calls, checking email, and making video/audio recordings.
In 2009 iPhone OS 3 was released by Apple, an update to the current iPhone operating system to add improvements and more functionality to their current iPhones, iPads, and iPod Touches [2], One of the new features this operating system included was a new application called Voice Memos. The Voice Memos application uses the devices microphone to record audio. After a user makes a recording, they can use the app to share their recording via email, text, or by syncing the device through Apples desktop iTunes application. The first version of Voice Memos also allowed users to make edits to recordings with a trimming feature that could be used to shorten the beginning or the end of recordings. Later updates to Voice Memos added more recording and editing capabilities.
1


Figure 1: Voice Memos app icon
This paper aims to explore the possibilities present when recording and editing audio using the Voice Memos application, as well as observing the characteristics of these recordings. Recordings were made across different versions of Apples mobile operating system, iOS (iPhone Operating System), which included three different versions of Voice Memos. A testing protocol presented at AES [4] was augmented to incorporate additional iOS versions. This protocol is based off of the different ways you can use Voice Memos to create and edit recordings and was used to guide the creation of the test recordings.
The characteristics of the tested audio recordings were compared with recordings from different versions of iOS to see what similarities and differences were present. Edited/altered recordings were also compared to original recordings in order to see how manipulated recordings predictably deviated from the originals. The observations were then added to a decision tree that was previously presented at AES and also used to make separate decision trees for different versions of iOS. The purpose of the decision tree is to create a quick way for someone to examine the traits of a recording and determine based on traits in the examined recording, if the recording is consistent with known recordings with known states (over recorded, trimmed, phone-call interrupted, etc.) from iOS Voice Memos or isnt.
2


Challenges
With the widespread use of smart phones, its been inevitable that smart phones would start to become a bigger part of police investigations. Data stored on phones such as calls, texts, emails, etc. has the potential to become evidence. Experts in the field of mobile phone and audio forensics have also noticed an increase in the amount of audio recording evidence coming from smart phones.
Often time, before an audio recording can be analyzed for the content heard on the recording, the authenticity of the recording needs to be determined. The Scientific Working Group on Digital Evidence (SWGDE) defines an audio authentication examination as one that seeks to determine if a recording is consistent with the manner in which it is alleged to have been produced [3], Now more then ever before, theres an abundance of audio editors available that make changing an audio recording very simple. This makes it very easy to challenge the authenticity of audio recording evidence that is used in trials. The more we know about what audio recordings from a device such as a smart phone look like and what their characteristics are, the easier it is to determine a recordings authenticity.
Another challenge of looking at audio recordings is that audio recordings often have similar characteristics. Using a computer, you can easily view the traits audio recordings have, file format, file size, sampling rate, bit rate, length of recording. A lot of these traits are similar between recording devices and dont help identify exactly which device created a recording or how it was created.
A lot of recording devices also allow users to edit an audio recording. Looking at the traits of a recording, it can be hard to identify if a device has edited a recording or not.
3


Further authenticity examination can help determine if edits are present in a recording or not. Identifying edits made by audio editors isnt usually too challenging but identifying if an app like Voice Memos made edits to a recording is harder to determine.
Previous Research
The decision tree developed to analyze audio recordings and that will also be discussed in more detail later in this thesis, was first presented at the annual AES (Audio Engineering Society) conference in June 2017. The presentation, Triage Approach for the Forensic Analysis of Apple iOS Audio Files Recorded Using the Voice Memos App discussed the decision tree and how it was developed and first tested by Jeff Smith, Douglas Lacey, Bruce Koenig, and Catalin Grigoras [4],
The decision tree was created based on observations of some of the main traits of audio recordings that were created with Voice Memos. These traits include the encoded audio type and the bit rate. The atom structure of files was also used to observe specific characteristics of the files such as the size of the data user atom. Some of these traits also help to distinguish between different versions of iOS that created the audio recording.
Its also important to note that when analyzing an audio recording from an iPhone, knowing which version of iOS is helpful as it can be used to distinguish between different audio files but knowing the iPhones model that created the recording is useless. It may be helpful during an investigation for the police to connect a recording made on a phone to a suspect who owns that same phone model but for discussing the analysis of Voice Memos audio recordings, the model that created the phone isnt important.
To initially test the accuracy and repeatability of the decision tree, one of the authors of Triage Approach for the Forensic Analysis of Apple iOS Audio Files
4


Recorded Using the Voice Memos App created twenty audio recordings that were then shared to the other three authors to test the decision tree blindly and independently of each other. These ,m4a files consisted of seventeen (17) recordings made using the iPhone/iPod Touch Voice Memos app, in differing states of originality, continuity, and alteration; two (2) original, continuous, and unaltered recordings made using third-party iPhone audio recording apps; and one (1) Voice Memos app recording re-encoded and saved using GoldWave audio editing software [4], Renaming recordings within the Voice Memos app has also already been found to not change the file content so files used for testing the decision tree were renamed TEST FILE 01.m4a through TEST FILE 20.m4a to eliminate any bias that couldve been introduced by the original file names of the recordings.
Test results from the authors using the decision tree helped update the version of the decision tree that was presented at AES. The testing helped illuminate the problems of having clear language to make the examiners decisions consistent as well as further information that needed to be included in the decision tree. Interpreting encoded and recording dates in the audio recordings file information was also found to be an area of inconsistency. While this information can be crucial in detecting discontinuities and alterations made with the Voice Memos app, the variables affecting these dates are derived from activities which result in both original, continuous files as well as original, discontinuous files making discrimination between the two difficult. Therefore, care must be exercised in interpreting these data fields in practice [4],
Its important to remember with the decision tree that the purpose of it is to be another tool for helping with the authentication process. Its meant to be a quick guide
5


for determining if a recording is consistent with known iOS Voice Memos recordings or not. An examiner should never only use the decision tree and should always conduct a complete and thorough authentication examination.
The decision tree is an ideal starting point in the authentication process for an audio recording suspected of being made with the Voice Memos app. With each new iOS release new testing will have to be done so the decision tree can be expanded upon with new information. Should new features be added into the Voice Memos app, the testing protocol for gathering data for the decision tree will also have to be updated.
6


CHAPTER II
VOICE MEMOS USER INTERFACE
Voice Memos was first introduced on the iPhone on June 17, 2009 through the iPhone OS 3 update [5], Voice Memos uses the devices microphone to record audio or if the device doesnt have a microphone, an external microphone or headphones with a microphone can be plugged into the headphone jack and Voice Memos will use the external microphone to record audio. This is the only way Voice Memos can record on the iPod Touch, which doesnt have a microphone built into the device.
The first version of Voice Memos allowed a user to make recordings by starting a recording and stopping it or a recording could be paused, then continued and stopped or paused again. Recordings were automatically named with the date and time the recording was made but could be renamed with preset names such as Podcast or with a custom name. The first version of Voice Memos also allowed a user to trim the recording by removing the beginning or the end to change what time in the original recording the playback would start or stop.
Once recordings are made, they can be synced to an iTunes library or shared directly from the app. If a user wants to extract their recordings from Voice Memos to a computer, they can use iTunes, Apples application for media playback and device management. A user would connect their iPhone to their computer and allow iTunes to synchronize with the device. iTunes would then automatically import and sort the recordings into its media library. A user could also share recordings by email or text directly from Voice Memos.
7


Figure 2: Original Voice Memos interface
Figure 3: Voice Memos recording
8


Figure 4: Renaming recordings
12:13 AM
00:06
Recorded on Monday, March 23, 2009
Trim Memo
Share
Figure 5: Trimming a recording


iOS 7
The next major update to Voice Memos came on September 18, 2013 when iOS 7 was released [6], The new Voice Memos app featured a new interface and introduced more options for recording and editing. The interface showed the waveform of the audio being recorded and played backed instead of the microphone and VU meter. Recordings were stored and categorized on the same screen as the rest of the interface under the top portion of the app where the waveform is shown.
ooo AT&T
67%
10:29
Record
00:03 00:04 00:05 00:06 00:07 00:0£l
"Kill'll ||l (Mllllll......IHK| ||i*
00:05.61
New Recording
o
Done
Figure 6: New interface in iOS 7
In iOS 7, recordings are made the same way by pressing record and then you have
the option to pause recording then continue recording or to stop. To stop a recording, the user presses done, then the user is prompted to name the recording instead of the app automatically saving the recording with the date and time of the recording. If a user
10


doesnt input a custom name, recordings will be automatically named as New Recording with newer recordings named by New Recording 2, New Recording 3, etc.
If a user was recording and exited the app to return to the home screen, a red bar would appear on the top of the device screen showing that recording was still taking place in the background. You could also pause in the middle of a recording and scroll back to an earlier section of the recording and continue recording from that section and record over the subsequent part of the recording. Recordings could also be deleted by swiping towards the left on the desired recording and a delete tab would appear next to the recording.
The same editing features were also available for the iOS 7 version of Voice Memos as were previously available. When a user selects a recording, they have the option to edit by pressing the edit button that appears next to the share button and the delete icon. Once edit is pressed, the waveform of the selected recording will appear in the upper section of the app and the user can then press a cropping icon that brings up the trim option. Like the previous version of Voice Memos, two selection bars will appear that allow the user to change when the recording starts or ends. In this version of Voice Memos, any trim edits made will automatically be applied over the original recording.
11


Trim
00:00.00 01:40.34
- t|n|| - -
01:40 34
Cancel Trim
Figure 7: Trim editing in iOS 7
Another new way of sharing Voice Memos recording was also introduced in iOS 7, Airdrop. Airdrop allows for file sharing between iOS devices or Mac computers using Wi-Fi and Bluetooth connections. Devices have to be in close proximity to each other in order for Airdrop to work. Once a file is sent through Airdrop, the user receiving a file will be prompted on their device to accept the file being sent. Besides Airdrop, in iOS 7 you can share Voice Memos recordings by email, text, or synching the device with iTunes.
iOS 11
The current version of Voice Memos hasnt changed much over the last few new iOS releases. The interface is exactly the same as it was in iOS 7 but allows for a few new options. The options for making recordings (record, pause, record, stop, done, save) are the same but at least since iOS 10, users can select an already existing recording and record over any part of it.
12


A new editing feature delete is also available. When you select a recording and press edit and then press the crop button, the red bars that appear can be used to make a selection of the recording, then you can choose to delete the audio in-between the red bars instead of trimming whats to the left and right of the bars. When making edits, you can now also choose to save an edited recording as a new recording or save over the original recording. If a user chooses to save an edited recording as a new recording, the recording name will stay the same but copy will be added to the recording name followed by copy 2, copy 3 for each consecutive recording.
The current version of Voice Memos allows for the same sharing and exporting options for the recordings, synching with iTunes, Airdrop, email, and text. Its also important to note that Voice Memos has never given users options to change the recording settings or recording quality settings. These settings are all automatic and built into the app. The different aspects of the recordings and the settings used to make them will be covered in the next chapter.
13


CHAPTER III
BACKGROUND ON DIGITAL AUDIO
To further discuss audio recordings made with Voice Memos, its important to understand some of the characteristics of digital audio recordings. Its also important to understand how the recordings are made and structured. This chapter will discuss audio and its traits so the later chapters talking about the unique features of Voice Memos recordings can be understood clearly. A whole paper could be written about how digital audio recordings are made and all the different aspects of them. To keep things simple, this section will discuss the different characteristics of audio that will relate to discussing the characteristics of recordings from Voice Memos.
The New Oxford American Dictionary defines sound as vibrations that travel through the air or another medium and can be heard when they reach a persons or animals ear. When sound is recorded, it can be recorded with analog technology/methods or by digital technology/methods. For analog recording the sound is captured through a microphone and physically recorded to tape that can then be read and played back to hear what was recorded. For digital recording sound is sampled at certain intervals and converted into numbers that can be read and stored by a digital device (computer, smart phone, digital recorder). One property of digital audio is its sampling rate.
Sampling Rate
The sampling rate determines how many times a second a sound being recorded is captured so it can be represented digitally. The sampling rate is measured in hertz (Hz)
14


or kilohertz (kHz). The higher the sampling rate, the higher the maximum frequency (pitch) that can be sampled (recorded). The most commonly used sample rate for CDs and digital audio is 44,100 Hz or 44.1 kHz. This means that the digital recorder sampled each second of an audio recording 44,100 times to capture the audio.
If a sampling rate is too low it can create problems in the audio that is recorded. The Nyquist Theorem states that a sampling rate should be at least double the rate of the highest frequency of audio being recorded [7], The highest frequency in this case refers to the highest pitch being heard in a sound being recorded. The frequency range of human hearing is usually defined as 20 Hz to 20,000 Hz [8], Sounds towards the lower end of the hearing range would be a trucks engine or the lowest notes on a piano. Sounds towards the higher end of the hearing range would be birds chirping or the highest notes on a piano. How loud these sounds are doesnt affect the pitch of them. So if we want to make sure we capture all the sounds our ears can hear, we need to be able to record sounds up to 20,000 Hz. Following the Nyquist Theorem, the sampling rate should always be at least 40,000 Hz. This is where the standard of 44,100 comes from.
Bit Rate
The bit rate is another important aspect of a digital recording that determines the overall quality. The bit rate refers to how much information is being stored in the digital file itself. For audio files, its usually referred to as kilobits per second (kbps). For example, songs downloaded from the iTunes store are usually 256 kbps. This means that when that song is played back, 256,000 bits of information are played back per second. Like with the sampling rate, the higher the bit rate the more accurate and better overall
15


quality the file will be. The higher the kbps, the more space the file will also take up on a storage device such as a computer or smart phone.
A digital audio file will have a constant bit rate if it was encoded (written) with a constant bit rate such as 256. Files can also be encoded with a variable bit rate where the bit rate will fluctuate throughout the audio file. If you look at the information of a file with a variable bit rate, you will most likely see an average bit rate displayed.
File Formats
Once audio has been recorded, it has to be stored somehow and be readable by devices so the audio can be played. Audio file formats store the digital audio data and allow files to be organized and played using media players. Many different audio file formats exist and offer different options. Some formats are lossless meaning they keep the entire original raw audio data, which creates big file sizes. Other formats are lossy meaning they remove information from the raw audio data to compress the file size.
Lossy compression formats also affect the quality of the audio stored in the files. Sometimes these compressed audio files wont sound any different to a listener while files that have been drastically compressed might have a more noticeable smaller, thinner, duller, sound to them.
Digital audio files are made up of two important parts, the container and the codec. The codec states the method in which the data it contains should be encoded (written) and decoded (played back). The container packages the codec and makes it understandable to a digital system. The container is also often the extension you see at the end of files such as .wav, a wave file format.
16


A good analogy to help make this concept of containers and codecs more easily understood is to think of a can of soup. In this case the container is the outside of the soup can, it has a label and list of ingredients to tell you whats in it, what it contains, and how it should be handled. The codec is then the soup itself. Some examples of containers are AIFF, WAV, M4A and some examples of codecs are FLAC, WMA, and MP3. Voice Memos recordings are AAC (advanced audio coding) that are contained in a M4A (moving pictures group 4 audio) file.
Atom Structure
All digital files contain metadata, which is information the file contains about itself. Metadata can contain information about when the file was created, what hardware or software created the file, or user information that created the file. This data can also be structured in a specific order that makes it easier to analyze and locate certain information. M4A Voice Memo recordings adhere to the QuickTime File Format Specification that lays out exactly how and where data is stored in digital files.
The data units in a QuickTime file are called atoms and are measured in bytes. Atoms also contain field types that describe what kind of data is stored in them [9],
Figure 8 below shows some examples of atom types. The field types are abbreviated to four letters versions of what the field type represents, such as udta which is short for user data atom. The metadata and atoms of a file can be viewed with a file information viewer (such as Medialnfo [11]) or a hex viewer (such as Hex Fiend [12]). Figure 9 shows an example of the ftyp atom seen using Hex Fiend. Other programs such as Atomic Parsley [13] can be used to show where certain atoms are in the file and how big
17


they are. For Voice Memos recordings the atoms of interest is the file type (ftyp), wide, movie header (mvhd), track header (tkhd), and the user data atom (udta).
Atom type Use
'ftyp' File type compatibilityidentifies the file type and differentiates it from similar file types, such as MPEG-4 files and JPEG-2000 files.
'moov' Movie resource metadata about the movie (number and type of tracks, location of sample data, and so on). Describes where the movie data can be found and how to interpret it.
'mdat' Movie sample data-media samples such as video frames and groups of audio samples. Usually this data can be interpreted only by using the movie resource.
'free' Unused space available in file.
'skip' Unused space available in file.
'wide' Reserved space-can be overwritten by an extended size field if the following atom exceeds 2*32 bytes, without displacing the contents of the following atom,
'pnot' Reference to movie preview data.
Figure 8: Different atom types
^ ftypM4A M4A mp42isom wide A
mdat AAA . dC d -iTOZAi# * L *n]>e-SÂ¥DBVÂ¥d d6yC ubuIidCb)4~u
X ~do]Yi e. 6 0[f.0!R¥0§$ OaC{e>TkPa
m-f J Gfy i Y% <>A...uAnMoQ}Y aa,, Figure 9: File type atom viewable in metadata
When analyzing audio recordings from Voice Memos, certain aspects of the files atom structure can also tell us which version of iOS created that file. The iOS version is usually easily viewable in the metadata.
A lot more could be discussed regarding the process of recording, storing, and
reading audio data. Many other papers exist on those topics already and for the purposes of this paper, the information in this chapter should be sufficient to move on and discuss the important information related to audio recordings from Voice Memos.
18


CHAPTER IV
TEST RECORDING COLLECTION PROTOCOL
As discussed in chapter 2, there are many variables introduced by the user when making recordings with the Voice Memos app. For example you can create a continuous one minute recording then press stop, done, save to finish making the recording. You could also make a continuous one minute recording then pressing stop, done, and press save a minute later. You could also pause the recording after a minute and start recording again a few minutes later then press stop, done, save.
To collect data from the audio recordings produced by Voice Memos, a testing protocol had to be developed. The testing protocol needed to make sure that all the data collected from Voice Memos would cover all the different ways and scenarios that a recording could be made from the app. A testing protocol for Voice Memos was first developed by Doug Lacey from Bek Tek LLC who was also one of the co authors of Triage Approach for the Forensic Analysis of Apple iOS Audio Files Recorded Using the Voice Memos app.
This testing protocol was originally developed based on iOS 10 and was a great starting point to gather data from Voice Memos. The first section of the original testing protocol covered continuous recordings with different orders of pauses and different order of operations for the stop, done, save process. It also covered receiving phone calls while Voice Memos was recordings. The protocol also covered making trim and deletion edits to recordings in Voice Memos with six different combinations made to original recordings then saved as copies of the original recordings. The editing
19


combinations were trimming/deleting from the beginning, the end, and from the beginning and the end of recordings.
The last section of the original testing protocol had a user transferring original recordings back into Voice Memos using a third party program. Once a recording was back on the phone, a trim or deletion edit was made and saved over the original recording. These edits were also trimming/deleting from the beginning, the end, and from the beginning and the end of the recordings. Once a user has made all the test recordings, they repeat the testing protocol two more times so theres three total complete sets of data. The testing protocol also follows the Voice Memos automatic file naming New Recording, New Recording 2 and when making edits, New Recording Copy, New Recording Copy 2, etc. The recordings that are transferred back onto the device are then edited and saved over the original recordings and manually named as Test For Overwrite 25 through Test For Overwrite 36. This makes it easy to keep track of which recording files match which testing scenario.
Updates to the Original Test Recording Protocol
The original testing protocol was updated to make a few small changes and add some new options for types of recordings and a new way to transfer recordings back into Voice Memos. The original protocol included making ten continuous one minute long recordings with stop, done, save pressed as fast as possible to the end recordings. The updated testing protocol narrowed these types of test recordings down to just three instead of ten. A column for Expected Output was also added to the protocol, showing what traits should be present in each test recording after theyre made.
20


The process of recording over original recordings was also added at the end of the protocol. Once a user has all the original recordings and all the edited recordings, they record again over all these recordings at different starting points. One set of over recordings starting at the beginning of an original recording and recording new audio for ten seconds. A second set of over recordings starting somewhere in the middle of an original recording and recording new audio for ten seconds. And a third set of over recordings starting ten seconds before the end of an original recording and recording new audio for twenty seconds to go beyond the original length of the recording.
A new method was also found to transfer original recordings back into the Voice Memos app. Instead of using third party software, iTunes can be used to transfer recordings into Voice Memos. You can import any audio recording into iTunes, then right click on the recording and select Get Info or Song Info. A new menu pops up with multiple tabs. Click on the Options tab. On this page theres a media kind section with a clickable pop down menu. On this menu you can tell iTunes what kind of recording the file is. One of the selections is Voice Memo. Once Voice Memo is selected, you can press OK to apply the changes to the recording file. Now the file can be synced or manually transferred onto an iOS device where the recording will be imported into the Voice Memos app. This process is included in the updated testing protocol. Figure 10 below also shows how to categorize an audio file as a Voice Memo in iTunes.
21


New Recording
Details Artwork Lyrics
Options
Sorting
media kir: v' Music
Podcast
star Audiobook
StO(
Voice Memo
playback d Remember playback position d Skip when shuffling
File
volume adjust -------------------------------
-100% None +100%
equalizer None
OK
Figure 10: How to categorize a file as a Voice Memo in iTunes
To confirm this process didnt change anything about the recording files, test recordings were hashed, imported into iTunes and transferred to an iPhone. Hashing a file or generating its checksum is when a unique string of numbers and letters can be created from the unique data present in a digital file using checksum software. This unique string of numbers and letters can be used to see if a digital file was changed during a transfer or download. If the data of a file is unchanged, the hash should also be
the same but if the file changes at all, the hash will be different.
New Recording.m4a
Name Hash Value
| SHA-256 6f9fbb843058f11b4f26f69a96ed61df22431734495d06c2cb20164fe1e0a22c
Figure 11: Example of a file hash
22


Once the test recordings were in the Voice Memos app, they were emailed from the app, downloaded and hashed again to see if the files had changed at all. The hash values were the same confirming that the process of transferring files to Voice Memos through iTunes didnt do anything to change the files.
After going through the testing protocol and making all the recordings in Voice Memos, the recordings can be collected by either emailing or airdropping directly from the app. The iPhone can also be synched with iTunes and all the Voice Memo recordings will be imported into the iTunes library. While the iTunes method is the quickest way to collect recordings, it also presents a challenge because while the recordings will appear in iTunes with the correct file names, the recordings are actually stored in a directory outside of iTunes where the filenames are labeled by the time/date. This makes it difficult to figure out exactly which recordings are which types of recording scenario. However, when files are emailed or airdropped they retain the correct file names.
Once the test recording protocol was updated, it was also split into three different versions. Each protocol version covers a different version of Voice Memos and how it records/makes edits differently from other versions of Voice Memos. So now theres a protocol for iOS 6 and previous, a protocol for iOS 7, and a protocol for iOS 10-11. The newest versions of the test recording protocols can be viewed in appendix A, B, and C.
23


CHAPTER V
NEW FINDINGS
Previous research has already helped us learn a lot about how Voice Memos makes audio recordings. Voice Memos saves recordings as AAC contained in a M4A format and records at 44.1 kHz and 64 kbps. When something in the recording file changes such as making a deletion edit from the middle of a recording, the file needs to be re encoded (re created) and when this happens the file stays at 44.1 kHz but the bit rate changes to 256 kbps.
The atom structures of files recorded on different versions of iOS are usually consistent with each other but theyre a couple of differences that are unique to a specific iOS version. The ftyp atom is 28 bytes, the wide atom is 8 bytes, the mvhd atom is 108 bytes, and the tkhd atom is 92 bytes. These parts of the atom structure havent been observed to change between different versions of iOS. However, the presence and size of the udta (user data) atom varies between different versions of iOS. For iOS 4 there is no udta atom. For iOS 6 the udta atom is 250 bytes. For iOS 7-10 the atom size is 307 to 360 bytes. For iOS 10, the udta atom size varies based on if the file was edited. When the file is edited, the original record date is removed causing the udta atom to shrink. Starting with iOS 7, the iOS version is reported in the metadata in the last set of bytes at the very end of the file as well and can be easily viewed with a hex viewer, such as Hex Fiend. iOS 4-6 doesnt report the iOS version in the metadata.
Figure 12: iOS version in metadata
24


All this information was used to create a decision tree to help quickly look at a recording and see if its consistent with known iOS Voice Memo recording data or not. When iOS 11 was released, new data was gathered from Voice Memos running on iOS 11 to add new data to a new decision tree just for iOS 11. New data collected from the test recording collection protocol was also used to make decision trees for the different versions of iOS that were tested, iOS 10, iOS 7, and iOS 6. The new decision trees can be viewed in appendix D, E, F, G, and H.
iOS 11
The current version of iOS is iOS 11 released on September 19, 2017. iOS 11 brought a lot of new changes to the iPhone but no major changes to Voice Memos [10], The interface has remained the same and the recording/editing options have stayed the same. Voice Memos also still records at 44.1 kHz and 64 kbps. When recordings are edited and or re encoded such as a deletion, the bit rate also changes to 256 kbps like it has in the past.
For the first time since iOS 7 the atom structure has changes. The wide atom has completely disappeared in iOS 11 recordings. However, the size of the udta atom has stayed consistent with the size of udta atoms from iOS 7-10, 307-360 bytes.
Test Recordings
The test recording collection protocol was used to collect data from a range of different versions of iOS. The iOS versions used fortesting were 4.0, 4.0.2, 6.1.3, 7.1.1, 10.3.2, 10.3.3, and 11.0.2. The iPhone models used fortesting were iPhone 6S, iPhone 4, iPhone 3G, and iPod Touch. A lot of the test recordings came out the way they were expected to with continuous recordings keeping the default sampling rate and bit rate.
25


Recordings that were edited and re encoded also had a changed bit rate of 256 kbps as expected.
One observation made on the test recordings was that when an edit was made to an original recording and then saved as a copy of that recording, the udta atom changed to a size of 307 bytes. This is because when the file is edited, the original record date is removed. This was observed on test recordings from iOS 11.0.2, 10.3.3 and 10.3.2. However, with iOS 7.1.1 edits didnt change the size of the udta atom because the original record date wasnt removed and always stayed intact. The udta atom size on iOS 4-6 wasnt included by default and we dont know if the udta atom size changes on iOS 8-9 because they werent available for testing.
Another observation made is that when an original recording had a section deleted from the middle of it, the bit rate changed from 64 kbps to 256 kbps. If sections were deleted or trimmed from the beginning or the end of the original recordings, the bit rate stayed the same at 64 kbps. Only when a section from the middle was deleted was a bit rate change noticed. It also didnt matter if the edited recording was saved as a copy or saved over the original recording, the bit rate always changed with this type of deletion edit. This type of test recording could only be performed on iOS 11.0.2, 10.3.3, and 10.3.2 because the deletion option isnt available on any of the older versions of iOS that were available to test.
Some of the test recordings also had a phone make a phone call to an iPhone that was already recording in Voice Memos. Voice Memos always paused recording when the iPhone received a call. When the call was ended, a user could continue recording or stop and save the recording. In cases where the recording was continued after the call
26


ended, the bit rate of the file changed from 64 kbps to 256 kbps. This was the only instance in the test recordings where a pause caused the bit rate to change; no manual pauses changed the bit rate in other test recordings. This type of test recording was also only performed on iOS 11.0.2, 10.3.3, and 10.3.2 because the available devices for testing older versions of iOS didnt have cellular service.
Over recordings were also only performed on iOS 11.0.2, 10.3.3, and 10.3.2 because these were the only available versions of iOS that provided the option to record over original audio files. When original recordings were recorded over again, the bit rate always changed from 64 kbps to 256 kbps and the sampling rate stayed the same at 44.1 kHz. It didnt matter if the over recording took place at the beginning of the file, the middle of the file, or the end of the file, the changes to the bit rate were always the same.
Another type of editing scenario that was briefly looked into was making edits to recordings on a newer version of iOS then the version that was used to make the recording. The purpose of this scenario is to see if the embedded iOS version changes after the files are edited on a different version of iOS. In the few recordings that were edited this way, the files embedded iOS version changed to the newer version of iOS that was used to edit the file. This was only done on a limited number of recordings and needs to be researched further.
There was one odd inconsistency with the test recordings from iOS 10.3.3, 10.3.2 and 11.0.2. Two of the sets of test recordings from 10.3.3 all had a sampling rate of 44.1 kHz no matter if they were continuous recordings, had pauses, or were edited in someway. The third set of recordings had some recordings that came out with a sampling rate of 48 kHz though. All three sets of test recordings from 10.3.2 had recordings with a
27


sampling rate of 48 kHz and some with 44.1 kHz. Theres no pattern to what recordings had what sampling rate between all three sets of data. Almost all the recordings across all three sets of data for iOS 11.0.2 were 48 kHz as well. When recordings that started at 48 kHz were edited and re encoded, the sampling rates also changed to 44.1 kHz across all the version of iOS that had original recordings at 48 kHz.
Other limited test recordings made oniOS 11.0.1, 11.0.3, and 11.1 also show recordings being made at 48 kHz and 44.1 kHz. Its clear that iOS 10-11 is capable of making recordings at a sampling rate of 44.1 kHz as well as 48 kHz. When Voice Memos is deciding to use what sampling rate though is unknown and no pattern has been observed that causes Voice Memos to record at 48 kHz.
28


CHAPTER VI
CONCLUSION
Voice Memos has changed a few times since its initial release but as weve seen after examining recordings from the app, even when it doesnt seem like Voice Memos has changed with a new version of iOS, that doesnt mean that Voice Memos isnt operating differently. Knowing these traits and patterns of how recordings change after certain functions are performed could potentially help investigators when analyzing audio recordings from Voice Memos. The characteristics could also help investigators identify what phones audio recordings came from as well if recordings have been edited in Voice Memos and how they were edited.
Future Research
New updates of iOS are usually released a couple times throughout the year. As new updates and new versions of iOS are released, the test recording collection protocol should be used to gather data from the new updates.
Sooner or later Apple is bound to also update Voice Memos in some major way.
If new features are added or new ways/scenarios of making recordings are possible, the test recording collection protocol will have to be updated to include the new changes.
This way good reliable data can continue to be collected from Voice Memos for the foreseeable future.
More testing also needs to be done to see how recordings that were made with older versions of iOS change after being edited on a newer version of iOS. This process could potentially be built into the test recording collection protocol for the future. The
29


differences in the record/encode dates of original unaltered recordings could also be measured to see if theyre consistent patterns for specific versions of iOS. If each version of iOS has a pattern to the difference between the record/encode dates, this could be used to identify recordings that came from an unknown version of iOS.
Data still needs to be collected from iOS 5, 8 and 9. The test recording collection protocol should be used to gather data from these versions of iOS so we know how those recordings compare with the recordings we have from other versions of iOS. Once all this data is complete, decision trees should be created for these versions of iOS. A decision tree for every version of iOS would be a great tool to aid in the authentication process and analysis of recordings made with Voice Memos.
The problem of random recordings with a sampling rate of 48 kHz in iOS 10-11 also needs to be solved. If some sort of unique scenario or interaction with Voice Memos or the iPhone itself is causing the sampling rate to change to 48 kHz, this could be very useful information for future analysis of Voice Memos recordings. This could also be valuable information for future iOS Voice Memo decision trees.
30


REFERENCES
1. Apple iPhone sales by year 2007-2016. (n.d.). Retrieved October 17, 2017, from https://www.statista.com/statistics/276306/global-apple-iphone-sales-since-fiscal-year-2007/
2. Diaz, J. (2009, March 17). IPhone 3.0 OS Guide: Everything You Need to Know. Retrieved November 01, 2017, from
https://gizmodo.com/5171796/iphone-30-os-guide-evervthing-vou-need-to-
know
3. SWGDE Digital and Multimedia Evidence Glossary, 2016-06-23, version 3.0.
4. Smith, J., Lacey, D., Koenig, B., & Grigoras, C. (2017). Triage Approach for the Forensic Analysis of Apple iOS Audio Files Recorded Using the Voice Memos App(pp. 1-10, Working paper). Arlington, VA: AES.
5. Ritchie, R. (2009, June 17). IPhone OS 3.0 review. Retrieved October 30, 2017, from https://www.imore.com/iphone-os-30-review
6. Caldwell, C. B. (2013, September 19). Get to know iOS 7: Voice Memos. Retrieved October 30, 2017, from
https://www.macworld.com/article/2048983/get-to-know-ios-7-voice-
memos.html
7. Hargrave, Frank (01/01/2001). "Nyquist theorem" in Hargrave's Communications Dictionary: Basic Terms, Equations, Charts and Illustrations (0-7803-6020-6, 978-0-7803-6020-4), (p. 363).
31


8. Elert, G. (n.d.). Frequency Range of Human Hearing. Retrieved October 30, 2017, from http://hvpertextbook.com/facts/20Q3/ChrisDAmbrose.shtml
9. QuickTime File Format Specification. (2016, September 13). Retrieved November 01, 2017, from
https://developer.apple.com/library/content/documentation/QuickTime/QTFF/
QTFFChap2/qtff2,html
10. IOS 11. (2017, November 01). Retrieved November 02, 2017, from https://www.macrumors.com/roundup/ios-ll/
11. Medialnfo. (n.d.). Retrieved November 09, 2017, from https://mediaarea.net/en/MediaInfo
12. Hex Fiend, (n.d.). Retrieved November 09, 2017, from http://ridiculousfish.com/hexfiend/
13. Furlong, W. (n.d.). Overview. Retrieved November 09, 2017, from https://bitbucket.org/wez/atomicparsley/overview
32


APPENDIX A
TEST RECORDING COLLECTION PROTOCOL iOS 10-11
IPHONE/IPOD TOUCH VOICE MEMOS
TEST RECORDING PROTOCOL
DOCUMENT THE FOLLOWING INFORMATION BEFORE PRODUCING TEST RECORDINGS:
iPhone/iPod Touch model number (via visual inspection of model number on back cover) (e.g.,
"A1522"). Cross reference with the following: o iPhone:
https://support.apple.com/en-us/HT201296
http: //www.apple.com/iphone/LTE/ (as needed) for LTE & country confirmation
http://www.everyi.com/by-identifler/ipod-iphone-ipad-specs-by-model-number-family- number.html
o iPod Touch:
https://support.apple.com/en-us/HT204217
http://www.everyi.com/by-identifler/ipod-iphone-ipad-specs-by-model-number-family- number.html
iPhone/iPod Touch "Model (via Settings/General/About/Model) (e.g., "MGAU2LL/A; refers to model, carrier, capacity,
& color) [TAKE SCREEN SNAP]. Cross reference with the following: o Apple Devices by Order Number: http://www.everyi.com/by-identifler/ipod-iphone-ipad- specs-bv-apple-
order-number-part-number.html
o iPhone 6S Model Numbers: http://leimobile.com/iphone-6s-model-numbers/ iPhone/iPod Touch serial number (via Settings/General/About/Serial Number) [TAKE SCREEN SNAP]


iOS version (via Settings/General/About/Version) [e.g., "9.2.1 (13D15)] [TAKE SCREENSNAP]
"Voice Memos default recording name for next recording, if known. "New Recording # is the default naming convention, with "# being a numerical value that increments with each new recording. Note that "# will be next numerical value for which no recording exists and may be out of chronological order. For example, if "New Recording 1,
"New Recording 3, and "New Recording 4 exist, the next recording will be "New Recording 2" and then "New Recording 5" after that.
34


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH IPHONE 6S (A1633. MKT32LL/Ai RUNNING IQS 11.0.2 (15A42U1:
STATE # DESCRIPTION EXPECTED OUTPUT REASON (S) 1
1 2 3 Continuous, 1-minute recording with "Stop", "Done", & "Save" pressed as quickly as possible in sequence at the end of the recording
CJ O 4 Continuous, 1-minute recording with "Stop" pressed to end the recording, then "Done" & "Save" pressed one minute later in sequence Basic metadata/file structure, note
5 Continuous, 1-minute recording with "Stop" and "Done" pressed to end the recording, then "Save" pressed one minute later 64 kbps, consistent record and encode dates differences between calculated recording length ("Encoded"/"Tagged" value minus
6 (iPhone only) Begin recording, call iPhone from landline or other mobile device (recording pauses automatically, note length of recording when paused), let call go to voicemail, press "Done" & "Save" as quickly as possible when the "Voice Memos" app screen returns to close out the recording "Recorded" value) and actual length of recording
7 Begin recording, perform pause stop/start events, three times each (1) with no vocal buzzing into or out of pause event, (2) with vocal buzzing into pause event, (3) with vocal buzzing out of pause event, & (4) with vocal buzzing into and out of pause event, stop recording 64 kbps, consistent record and encode dates Note differences between calculated recording length ("Encoded"/"Tagged" value minus "Recorded" value) and actual length of recording
3 Begin recording for one minute, perform pause event, leave paused for two minutes, resume recording for one minute, "Stop", "Done", & "Save" pressed as quickly as possible in sequence at the end of the recording 64 kbps, consistent record and encode dates Time/frequency characteristics of pause
9 Begin recording for one minute, perform pause event, leave paused for two minutes, resume recording for one minute, "Stop" pressed to end the recording, then "Done" & "Save" pressed one minute later in sequence stop/start events
Page 2 of 12
35


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH IPHONE 6S (A1633. MKT32LL/A) RUNNING IQS 11.0.2 (15A42H1:
STATE # DESCRIPTION EXPECTED OUTPUT REASON(S)
DISCONTINUOS 10 Begin recording for one minute, perform pause event, leave paused for two minutes, resume recording for one minute, "Stop" and "Done" pressed to end the recording, then "Save" pressed one minute later 64 kbps, consistent record and encode dates Note differences between calculated recording length ("Encoded"/"Tagged" value minus "Recorded" value) and actual length of recording
11 (iPhone only) Begin recording, call iPhone from landline or other mobile device (recording pauses automatically, note length of recording when paused), let call goto voicemail, resume recording when the "Voice Memos" app screen returns, record until total length of recording is two minutes, "Stop", "Done", & "Save" pressed as quickly as possible in sequence at the end of the recording
12 (iPhone only) Repeat Test #7 with calls to iPhone from landline or other mobile device, only one time each (total of four calls forvocal buzzing combinations), decline calls to speed up the process 64 kbps, consistent record and encode dates Basic metadata/file structure, time/frequency characteristics of incoming call stop/start events
DOWNLOAD TEST RECORDINGS 1->12
At least one dav after Test Recording #1 made above, select "Edit", click on icon for
selecting edit points, move start edit point to *20-second point so that recording
nr 13 length shows ~40 seconds, select "Delete" (removes last 40 seconds of the recording),
lZ select "Save As New Recording" (should be "New Recording # Copy" by default), select
g "Done"
z. At least one dav after Test Recording #1 made above, select "Edit", click on icon for
Q LU selecting edit points, move start edit point to 20-second point so that recording
CC LU 14 length shows ~40 seconds, select "Trim" (keeps last 40 seconds of the recording),
1 1 < select "Save As New Recording" (should be "New Recording # Copy 2" by default), Basic metadata/file structure, note changes
select "Done" 64 kbps, record dates not present to "Recorded", "Encoded", and/or "Tagged"
At least one dav after Test Recording #1 made above, select "Edit", click on icon for values
selecting edit points, move end edit point to *20-second point so that recording
1 C length shows ~20 seconds, select "Trim" (keeps first 20 seconds of the recording and
Lj removes last 40 seconds), select "Save As New Recording" (should be "New Recording
# Copy 3" by default), select "Done"
Page 3 of 12
36


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH IPHONE 6S (A1633. MKT32LL/A) RUNNING IQS 11.0.2 (15A42111:
STATE # DESCRIPTION EXPECTED OUTPUT REASON(S)
ALTERED [NEW FILE) 16 At least one dav after Test Recording #1 made above, select "Edit", click on icon for selecting edit points, move end edit point to *20-second point so that recording length shows *20 seconds, select "Delete" (removes first 20 seconds of the recording and keeps last 40 seconds), select "Save As New Recording" (should be "New Recording # Copy 4" by default), select "Done" 64 kbps (test 17, 256 kbps), record dates not present Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or "Tagged" values
17 At least one dav after Test Recording #1 made above, select "Edit", click on icon for selecting edit points, move start edit point to *20-second point and end edit point to *40-second point so that recording length shows *20 seconds, select "Delete" (removes these 20 seconds from the recording), select "Save As New Recording" (should be "New Recording # Copy 5" by default), select "Done"
18 At least one dav after Test Recording #1 made above, select "Edit", click on icon for selecting edit points, move start edit point to *20-second point and end edit point to *40-second point so that recording length shows *20 seconds, select 'Trim" (keeps these 20 seconds of the recording), select "Save As New Recording" (should be "New Recording # Copy 6" by default), select "Done"
DOWNLOAD TEST RECO! RDINGS 13-H8
i/> 1 Q At least one dav after Test Recording #8 made above, select "Edit", click on icon for
3 O selecting edit points, move start edit point to *20-second point so that recording
i a length shows *1:40, select "Delete" (removes last 1:40 seconds of the recording).
1- u- select "Save As New Recording" (should be "New Recording # Copy" by default),
8 § select "Done"
i/> At least one dav after Test Recording #8 made above, select "Edit", click on icon for Basic metadata/file structure, note
O o3 20 selecting edit points, move start edit point to *20-second point so that recording 64 kbps, record dates not present changes to "Recorded", "Encoded",
O length shows *1:40, select 'Trim" (keeps last 1:40 seconds of the recording), select and/or "Tagged" values
oc LLI "Save As New Recording" (should be "New Recording # Copy 2" by default),
1 1 < select "Done"
Page 4 of 12
37


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH IPHONE 6S (A1633. MKT32LL/A) RUNNING IQS 11.0.2 (15A42111:
21 At least one dav after Test Recording #8 made above, select "Edit", click on icon for selecting edit points, move end edit point to =20-second point so that recording length shows =20 seconds, select "Trim" (keeps first 20 seconds of the recording and removes last 1:40 seconds), select "Save As New Recording" (should be "New Recording # Copy 3" by default), select "Done"
22 At least one dav after Test Recording #8 made above, select "Edit", click on icon for selecting edit points, move end edit point to =20-second point so that recording length shows =20 seconds, select "Delete" (removes first 20 seconds of the recording and keeps last 1:40 seconds), select "Save As New Recording" (should be "New Recording # Copy 4" by default), select "Done" 64 kbps (test 23, 256 kbps), record dates not present Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or "Tagged" values
23 At least one dav after Test Recording #8 made above, select "Edit", click on icon for selecting edit points, move start edit point to =20-second point and end edit point to =40-second point so that recording length shows =20 seconds, select "Delete" (removes these 20 seconds from the recording), select "Save As New Recording (should be "New Recording # Copy 5" by default), select "Done"
24 At least one dav after Test Recording #8 made above, select "Edit", click on icon for selecting edit points, move start edit point to =20-second point and end edit point to =40-second point so that recording length shows =20 seconds, select "Trim" (keeps these 20 seconds of the recording), select "Save As New Recording" (should be "New Recording # Copy 6" by default), select "Done"
DOWNLOAD RECORDINGS 19-24. COPY THE DOWNLOADED TEST RECORDING #1 ABOVE TO A NEW FILE NAMED "TEST FOR OVERWRITE 25" ON THE COMPUTER. IMPORT NEW FILE INTO iTUNES. RIGHT CLICK ON FILE AND SELECT "GET INFO". CLICK ON "OPTIONS" TAB ON MENU THAT POPS UP. UNDER "MEDIA KIND" SELECT "VOICE MEMO" AND PRESS "OK". DRAG FILE ONTO PHONE TO IMPORT VOICE MEMO.
Page 5 of 12
38


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH IPHONE 6S (A1633. MKT32LL/A) RUNNING IQS 11.0.2 (15A42111:
STATE # DESCRIPTION EXPECTED OUTPUT REASON(S)
ALTERED (OVERWRITE FILE) 25 At least one dav after Test Recording #1 made above, choose the transferred "TEST FOR OVERWRITE 25" recording, select "Edit", click on icon for selecting edit points, move start edit point to 20-second point so that recording length shows *40 seconds, select 'Trim" (keeps last 40 seconds of the recording), select "Trim Original" (resulting file will have the same name) 64 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or "Tagged" values
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 25" FILE, DELETE IT FROM THE IPHONE/IPOD TOUCH, RE-NAME THE UNMODIFIED "TEST FOR OVERWRITE 25" TO "...26" & TRANSFER IT FROM THE COMPUTER TO THE IPHONE/IPOD TOUCH "VOICE MEMOS" APP (OR VIA OTHER METHOD).
ALTERED (OVERWR 25 At least one dav after Test Recording #1 made above, choose the transferred "TEST FOR OVERWRITE 26" recording, select "Edit", click on icon for selecting edit points, move start edit point to *20-second point so that recording length shows *40 seconds, select "Delete" (removes last 40 seconds of the recording), select "Delete From Original" (resulting file will have the same name) 64 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or "Tagged" values
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 26" FILE, DELETE IT FROM THE IPHONE/IPOD TOUCH, RE-NAME THE UNMODIFIED "TEST FOR OVERWRITE 26" TO "...27" & TRANSFER IT FROM THE COMPUTER TO THE IPHONE/IPOD TOUCH "VOICE MEMOS" APP (OR VIA OTHER METHOD).
ALTERED (OVERWRITE FILE) 27 At least one dav after Test Recording #1 made above, choose the transferred "TEST FOR OVERWRITE 27" recording, select "Edit", click on icon for selecting edit points, move end edit point to *20-second point so that recording length shows 20 seconds, select "Trim" (keeps first 20 seconds of the recording and removes last 40 seconds), select 'Trim Original" (resulting file will have the same name) 64 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or "Tagged" values
Page 6 of 12
39


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH IPHONE 6S (A1633, MKT32LL/A) RUNNING IQS 11.0.2 (15A42111:
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 27" FILE, DELETE IT FROM THE IPHONE/IPOD TOUCH, RE-NAME THE UNMODIFIED "TEST FOR OVERWRITE 27" TO "...28" & TRANSFER IT FROM THE COMPUTER TO THE IPHONE/IPOD TOUCH "VOICE MEMOS" APP (OR VIA OTHER METHOD).
ALTERED (OVERWRITE FILE) 28 At least one dav after Test Recording #1 made above, choose the transferred "TEST FOR OVERWRITE 28" recording, select "Edit", click on icon for selecting edit points, move end edit point to 20-second point so that recording length shows *20 seconds, select "Delete" (removes first 20 seconds of the recording and keeps last 40 seconds), select "Delete From Original" (resulting file will have the same name) 64 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or "Tagged" values
Page 7 of 12
40


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH IPHONE 6S (A1633. MKT32LL/A) RUNNING IQS 11.0.2 (15A42111:
STATE #__________________________________DESCRIPTION_______________________________________EXPECTED OUTPUT________________________REASONjS)
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 28" FILE, DELETE IT FROM THE IPHONE/IPOD TOUCH, RE-NAME THE UNMODIFIED "TEST FOR OVERWRITE 28" TO "...29" & TRANSFER IT FROM THE COMPUTER TO THE __________________IPHONE/IPOD TOUCH "VOICE MEMOS" APP (OR VIA OTHER METHOD)._________________
ALTERED (OVERWRITE -i i r-1 29 At least one dav after Test Recording #1 made above, choose the transferred "TEST FOR OVERWRITE 29" recording, select "Edit", click on icon for selecting edit points, move start edit point to =20-second point and end edit point to =40-second point so that recording length shows *20 seconds, select "Delete" (removes these 20 seconds from the recording), select "Delete From Original" (resulting file will have the same name) 256 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or"Tagged" values
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 29" FILE, DELETE IT FROM THE IPHONE/IPOD TOUCH, RE-NAME THE UNMODIFIED "TEST FOR OVERWRITE 29" TO "...30" & TRANSFER IT FROM THE COMPUTER TO THE IPHONE/IPOD TOUCH "VOICE MEMOS" APP (OR VIA OTHER METHOD).
ALTERED (OVERWRITE - rl 30 At least one dav after Test Recording #1 made above, choose the transferred "TEST FOR OVERWRITE 30" recording, select "Edit", click on icon for selecting edit points, move start edit point to ~20-second point and end edit point to ~40-second point so that recording length shows =20 seconds, select "Trim" (keeps these 20 seconds of the recording), select "Trim Original" (resulting file will have the same name) 64 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or"Tagged" values
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 30" FILE
Page 8 of 12
41


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH IPHONE 6S (A1633. MKT32LL/A) RUNNING IQS 11.0.2 (15A42111:
STATE #__________________________________DESCRIPTION______________________________________EXPECTED OUTPUT__________________________REASON(S)
COPY THE DOWNLOADED TEST RECORDING #8 ABOVE TO A NEW FILE NAMED "TEST FOR OVERWRITE 31" ON THE COMPUTER. IMPORT NEW FILE INTO iTUNES. RIGHT CLICK ON FILE AND SELECT "GET INFO". CLICK ON "OPTIONS" TAB ON MENU THAT POPS UP. UNDER "MEDIA KIND" SELECT "VOICE MEMO" AND PRESS "OK". DRAG FILE ONTO
PHONE TO IMPORT VOICE MEMO.
VJ LU D -i c>8 O At least one day after Test Recording #8 made above, choose the transferred "TEST
ale O. P III < a > 31 FOR OVERWRITE 31" recording, select "Edit", click on Icon for selecting edit points, move start edit point to ~20-second point so that recording length shows 1:40 seconds, select "Trim" (keeps last 1:40 of the recording), select "Trim Original" 64 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or"Tagged" values
(resulting file will have the same name)
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 31" FILE, DELETE IT FROM THE IPHONE/IPOD TOUCH, RE-NAME THE UNMODIFIED "TEST FOR OVERWRITE 31" TO "...32" & TRANSFER IT FROM THE COMPUTER TO THE IPHONE/IPOD TOUCH "VOICE
MEMOS" APP (OR VIA OTHER METHOD).
a 3 68 O u- o i H At least one dav after Test Recording #8 made above, choose the transferred "TEST FOR OVERWRITE 32" recording, select "Edit", click on icon for selecting edit points, Basic metadata/file structure, note
S Z 1 32 move start edit point to 20-second point so that recording length shows 1:40 64 kbps, inconsistent record and
SOS < 2 > Q o seconds, select "Delete" (removes last 1:40 of the recording), select "Delete From Original" (resulting file will have the same name) encode dates and/or"Tagged values
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 32" FILE, DELETE IT FROM THE IPHONE/IPOD TOUCH, RE-NAME THE UNMODIFIED "TEST FOR OVERWRITE 32" TO "...33" & TRANSFER IT FROM THE COMPUTER TO THE IPHONE/IPOD TOUCH "VOICE ___________________________________MEMOS" APP (OR VIA OTHER METHOD).___________________________________
Page 9 of 12
42


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH IPHONE 6S (A1633. MKT32LL/A) RUNNING IQS 11.0.2 (15A42111:
STATE # DESCRIPTION EXPECTED OUTPUT REASON(S)
ALTERED & DISCONTINUOUS (OVERWRITE FILE) 33 At least one dav after Test Recording #8 made above, choose the transferred "TEST FOR OVERWRITE 33" recording, select "Edit", click on icon for selecting edit points, move end edit point to 20-second point so that recording length shows *20 seconds, select "Trim" (keeps first 20 seconds of the recording and removes last 1:40 seconds), select "Delete From Original" (resulting file will have the same name) [effectively the same as Test Recording #32 but using end edit point] 64 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or"Tagged" values
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 33" FILE, DELETE IT FROM THE IPHONE/IPOD TOUCH, RE-NAME THE UNMODIFIED "TEST FOR OVERWRITE 33" TO "...34" & TRANSFER IT FROM THE COMPUTER TO THE IPHONE/IPOD TOUCH "VOICE MEMOS" APP (OR VIA OTHER METHOD).
ALTERED & DISCONTINUOUS (OVERWRITE FILE) 34 At least one dav after Test Recording #8 made above, choose the transferred "TEST FOR OVERWRITE 34" recording, select "Edit", click on icon for selecting edit points, move end edit point to 20-second point so that recording length shows 20 seconds, select "Delete" (removes first 20 seconds of the recording and keeps last 1:40 seconds), select "Delete From Original" (resulting file will have the same name) 64 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or "Tagged" values
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 34" FILE, DELETE IT FROM THE IPHONE/IPOD TOUCH, RE-NAME THE UNMODIFIED "TEST FOR OVERWRITE 34" TO "...35" & TRANSFER IT FROM THE COMPUTER TO THE IPHONE/IPOD TOUCH "VOICE MEMOS" APP (OR VIA OTHER METHOD).
Page 10 of 12
43


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH IPHONE 6S (A1633, MKT32LL/A) RUNNING IQS 11.0.2 (15A42111:
Vi lZT D = o3 O u- g 1 B5 At least one dav after Test Recording #8 made above, choose the transferred "TEST FOR OVERWRITE 35" recording, select "Edit", click on icon for selecting edit points, Basic metadata/file structure, note
C h K Pgg move start edit point to 20-second point and end edit point to *40-second point so 256 kbps, inconsistent record and changes to "Recorded", "Encoded",
< % > a o that recording length shows *20 seconds, select "Delete" (removes these 20 seconds from the recording), select "Delete From Original" (resulting file will have the same name) encode dates and/or"Tagged" values
Page 11 of 12
44


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH IPHONE 6S (A1633. MKT32LL/A) RUNNING IQS 11.0.2 (15A42111:
STATE # DESCRIPTION EXPECTED OUTPUT REASON(S)
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 35" FILE, DELETE IT FROM THE IPHONE/IPOD TOUCH, RE-NAME THE UNMODIFIED "TEST FOR OVERWRITE 35" TO "...36" & TRANSFER IT FROM THE COMPUTER TO THE IPHONE/IPOD TOUCH "VOICE MEMOS" APP (OR VIA OTHER METHOD).
ALTERED & DISCONTINUOUS (OVERWRITE FILE) 36 At least one dav after Test Recording #8 made above, choose the transferred "TEST FOR OVERWRITE 36" recording, select "Edit", click on icon for selecting edit points, move start edit point to 20-second point and end edit point to 40-second point so that recording length shows =20 seconds, select "Trim" (keeps these 20 seconds of the recording), select "Delete From Original" (resulting file will have the same name) 64 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or "Tagged" values
DOWNLOAD MODIFIED "TEST FOR OVERWRITE 36" FILE. DOWNLOAD THE MODIFIED FILES. IMPORT RECORDINGS 1-36 INTO iTUNES. RIGHT CLICK ON FILE AND SELECT "GET INFO". CLICK ON "OPTIONS" TAB ON MENU THAT POPS UP. UNDER "MEDIA KIND" SELECT "VOICE MEMO" AND PRESS "OK". DRAG FILE ONTO PHONE TO IMPORT VOICE MEMO.
ALTERED & DISCONTINUOUS (OVERWRITE FILE) 37 Transfer recordings 1-36 back onto device. Over record recordings 1-36 three different times, start at beginning and over record the file for 10 seconds, start in middle and over record the file for 10 seconds, record 10 seconds before end of recording and over record for 20 seconds. Re import recordings 1-36 for each different type of over recording. 256 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or "Tagged" values
Page 12 of 12
45


APPENDIX B
TEST RECORDING COLLECTION PROTOCOL iOS 7
IPHONE/IPOD TOUCH VOICE MEMOS
TEST RECORDING PROTOCOL
DOCUMENT THE FOLLOWING INFORMATION BEFORE PRODUCING TEST RECORDINGS:
iPhone/iPod Touch model number (via visual inspection of model number on back cover) (e.g.,
"A1522"). Cross reference with the following: o iPhone:
https://support.apple.com/en-us/HT201296
http: //www.apple.com/iphone/LTE/ (as needed) for LTE & country confirmation
http://www.everyi.com/by-identifler/ipod-iphone-ipad-specs-by-model-number-family- number.html
o iPod Touch:
https://support.apple.com/en-us/HT204217
http://www.everyi.com/by-identifler/ipod-iphone-ipad-specs-by-model-number-family- number.html
iPhone/iPod Touch "Model (via Settings/General/About/Model) (e.g., "MGAU2LL/A; refers to model, carrier, capacity,
& color) [TAKE SCREEN SNAP]. Cross reference with the following: o Apple Devices by Order Number: http://www.everyi.com/by-identifler/ipod-iphone-ipad- specs-bv-apple-
order-number-part-number.html
o iPhone 6S Model Numbers: http://leimobile.com/iphone-6s-model-numbers/ iPhone/iPod Touch serial number (via Settings/General/About/Serial Number) [TAKE SCREEN SNAP]
_________ iOS version (via Settings/General/About/Version) [e.g., "9.2.1 (13D15)] [TAKE SCREENSNAP]__________
46


"Voice Memos default recording name for next recording, if known. "New Recording # is the default naming convention, with "# being a numerical value that increments with each new recording. Note that "# will be next numerical value for which no recording exists and may be out of chronological order. For example, if "New Recording 1,
"New Recording 3, and "New Recording 4 exist, the next recording will be "New Recording 2" and then "New Recording 5" after that.
47


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH IPHONE 4 (A1332) RUNNING IQS 7.1.1 (11D20D1:
STATE # DESCRIPTION EXPECTED OUTPUT REASON(S) 1
1 2 3 Continuous, 1-minute recording with "Stop", "Done", & "Save" pressed as quickly as possible in sequence at the end of the recording
CJ O 4 Continuous, 1-minute recording with "Stop" pressed to end the recording, then "Done" & "Save" pressed one minute later in sequence Basic metadata/file structure, note
5 Continuous, 1-minute recording with "Stop" and "Done" pressed to end the recording, then "Save" pressed one minute later 64 kbps, consistent record and encode dates differences between calculated recording length
6 (iPhone only) Begin recording, call iPhone from landline or other mobile device (recording pauses automatically, note length of recording when paused), let call go to voicemail, press "Done" & "Save" as quickly as possible when the "Voice Memos" app screen returns to close out the recording ("Encoded"/"Tagged" value minus "Recorded" value) and actual length of recording
7 Begin recording, perform pause stop/start events, three times each (1) with no vocal buzzing into or out of pause event, (2) with vocal buzzing into pause event, (3) with vocal buzzing out of pause event, & (4) with vocal buzzing into and out of pause event, stop recording 64 kbps, consistent record and encode dates Note differences between calculated recording length ("Encoded"/"Tagged" value minus "Recorded" value) and actual length of recording
8 Begin recording for one minute, perform pause event, leave paused for two minutes, resume recording for one minute, "Stop", "Done", & "Save" pressed as quickly as possible in sequence at the end of the recording 64 kbps, consistent record and encode Time/frequency characteristics of pause
9 Begin recording for one minute, perform pause event, leave paused for two minutes, resume recording for one minute, "Stop" pressed to end the recording, then "Done" & "Save" pressed one minute later in sequence dates stop/start events
Page 2 of 7
48


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH IPHONE 4 (A1332) RUNNING IQS 7.1.1 (11D20H1:
STATE # DESCRIPTION EXPECTED OUTPUT REASON(S)
DISCONTINUQS 10 Begin recording for one minute, perform pause event, leave paused for two minutes, resume recording for one minute, "Stop" and "Done" pressed to end the recording, then "Save" pressed one minute later 64 kbps, consistent record and encode dates Note differences between calculated recording length ("Encoded"/"Tagged" value minus "Recorded" value) and actual length of recording
ii (iPhone only) Begin recording, call iPhone from landline or other mobile device (recording pauses automatically, note length of recording when paused), let call goto voicemail, resume recording when the "Voice Memos" app screen returns, record until total length of recording is two minutes, "Stop", "Done", & "Save" pressed as quickly as possible in sequence at the end of the recording
12 (iPhone only) Repeat Test #7 with calls to iPhone from landline or other mobile device, only one time each (total of four calls forvocal buzzing combinations), decline calls to speed up the process 64 kbps, consistent record and encode dates Basic metadata/file structure, time/frequency characteristics of incoming call stop/start events
DOWNLOAD TEST RECORDINGS 1->12
LLI At least one dav after Test Recording #1 made above, select "Edit", click on icon for
1 LL. selecting edit points, move start edit point to 20-second point so that recording
3 13 length shows ~40 seconds, select "Trim" (keeps last 40 seconds of the recording),
LU Z, select "Save As New Recording" (should be "New Recording # Copy 2" by default),
o select "Done"
oc LU 64 kbps, inconsistent record and encode Basic metadata/file structure, note changes
1 1 < At least one dav after Test Recording #1 made above, select "Edit", click on icon for dates to "Recorded", "Encoded", and/or "Tagged"
selecting edit points, move end edit point to ~20-second point so that recording values
length shows *20 seconds, select "Trim" (keeps first 20 seconds of the recording and
14 removes last 40 seconds), select "Save As New Recording" (should be "New Recording
# Copy 3" by default), select "Done"
Page 3 of 7
49


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH IPHONE 4 (A1332) RUNNING IQS 7.1.1 (11D20H1:
STATE # DESCRIPTION EXPECTED OUTPUT REASON(S)
ALTERED (NEW FILE) 15 At least one dav after Test Recording #1 made above, select "Edit", click on icon for selecting edit points, move start edit point to ~20-second point and end edit point to ~40-second point so that recording length shows -20 seconds, select "Trim" (keeps these 20 seconds of the recording), select "Save As New Recording" (should be "New Recording # Copy 6" by default), select "Done" 64 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or 'Tagged' values
16 At least one dav after Test Recording #8 made above, select "Edit", click on icon for selecting edit points, move start edit point to 20-second point so that recording length shows -1:40, select "Delete" (removes last 1:40 seconds of the recording), select "Save As New Recording" (should be "New Recording # Copy" by default), select "Done"
ALTERED & DISCONTINUOUS (NEW FILE) 17 At least one dav after Test Recording #8 made above, select "Edit", click on icon for selecting edit points, move end edit point to 20-second point so that recording length shows 20 seconds, select "Trim" (keeps first 20 seconds of the recording and removes last 1:40 seconds), select "Save As New Recording" (should be "New Recording # Copy 3" by default), select "Done" 64 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or "Tagged' values
IS At least one dav after Test Recording #8 made above, select "Edit, click on icon for selecting edit points, move start edit point to -20-second point and end edit point to 40-second point so that recording length shows 20 seconds, select "Trim" (keeps these 20 seconds of the recording), select "Save As New Recording" (should be "New Recording # Copy 6" by default), select "Done"
Page 4 of 7
50


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH IPHONE 4 (A1332) RUNNING IQS 7.1.1 (11D20D1:
DOWNLOAD RECORDINGS 13-18. COPY THE DOWNLOADED TEST RECORDING #1 ABOVE TO A NEW FILE NAMED "TEST FOR OVERWRITE 19" ON THE COMPUTER. IMPORT NEW FILE INTO iTUNES. RIGHT CLICK ON FILE AND SELECT "GET INFO". CLICK ON "OPTIONS" TAB ON MENU THAT POPS UP. UNDER "MEDIA KIND" SELECT "VOICE MEMO" AND PRESS "OK". DRAG FILE ONTO PHONE TO IMPORT VOICE MEMO.
STATE # DESCRIPTION EXPECTED OUTPUT REASON(S)
ALTERED (OVERWRITE FILE) 19 At least one dav after Test Recording #1 made above, choose the transferred "TEST FOR OVERWRITE 19" recording, select "Edit", click on icon for selecting edit points, move start edit point to ~20-second point so that recording length shows *40 seconds, select "Trim (keeps last 40 seconds of the recording), select "Trim Original (resulting file will have the same name) 64 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded, "Encoded, and/or "Tagged values
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 19" FILE, DELETE IT FROM THE IPHONE/IPOD TOUCH, RE-NAME THE UNMODIFIED "TEST FOR OVERWRITE 19" TO "...20" & TRANSFER IT FROM THE COMPUTER TO THE IPHONE/IPOD TOUCH "VOICE MEMOS" APP (OR VIA OTHER METHOD).
ALTERED (OVERWRITE FILE) 20 At least one dav after Test Recording #1 made above, choose the transferred "TEST FOR OVERWRITE 20" recording, select "Edit", click on icon for selecting edit points, move end edit point to *20-second point so that recording length shows *20 seconds, select 'Trim" (keeps first 20 seconds of the recording and removes last 40 seconds), select "Trim Original (resulting file will have the same name) 64 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded, "Encoded, and/or "Tagged" values
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 20" FILE, DELETE IT FROM THE IPHONE/IPOD TOUCH, RE-NAME THE UNMODIFIED "TEST FOR OVERWRITE 20" TO "...21" & TRANSFER IT FROM THE COMPUTER TO THE IPHONE/IPOD TOUCH "VOICE MEMOS" APP (OR VIA OTHER METHOD).
Page 5 of 7
51


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH IPHONE 4 (A1332) RUNNING IQS 7.1.1 (11D20D1:
ALTERED (OVERWRITE i-ii r-\ 21 At least one dav after Test Recording #1 made above, choose the transferred "TEST FOR OVERWRITE 21" recording, select "Edit", click on icon for selecting edit points, move start edit point to 20-second point and end edit point to *40-second point so that recording length shows *20 seconds, select "Trim" (keeps these 20 seconds of the recording), select "Trim Original" (resulting file will have the same name) 64 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or"Tagged" values
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 21" FILE
COPY THE DOWNLOADED TEST RECORDING #8 ABOVE TO A NEW FILE NAMED "TEST FOR OVERWRITE 22" ON THE COMPUTER. IMPORT NEW FILE INTO iTUNES. RIGHT CLICK ON FILE AND SELECT "GET INFO". CLICK ON "OPTIONS" TAB ON MENU THAT POPS UP. UNDER "MEDIA KIND" SELECT "VOICE MEMO" AND PRESS "OK". DRAG FILE ONTO PHONE TO IMPORT VOICE MEMO.
ALTERED & DISCONTINUOUS (OVERWRITE FILE) 22 At least one dav after Test Recording #8 made above, choose the transferred "TEST FOR OVERWRITE 22" recording, select "Edit", click on icon for selecting edit points, move start edit point to *20-second point so that recording length shows 1:40 seconds, select "Trim" (keeps last 1:40 of the recording), select "Trim Original" (resulting file will have the same name) 64 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or"Tagged" values
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 22" FILE, DELETE IT FROM THE IPHONE/IPOD TOUCH, RE-NAME THE UNMODIFIED "TEST FOR OVERWRITE 22" TO "...23" & TRANSFER IT FROM THE COMPUTER TO THE IPHONE/IPOD TOUCH "VOICE ___________________________________MEMOS" APP (OR VIA OTHER METHOD).___________________________________
Page 6 of 7
52


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH IPHONE 4 (A1332) RUNNING IQS 7.1.1 (11D20D1:
ALTERED & DISCONTINUOUS (OVERWRITE 23 At least one day after Test Recording #8 made above, choose the transferred "TEST FOR OVERWRITE 23" recording, select "Edit", click on icon for selecting edit points, move end edit point to *20~second point so that recording length shows *20 seconds, select "Trim" (keeps first 20 seconds of the recording and removes last 1:40 seconds), select "Delete From Original" (resulting file will have the same name) [effectively the same as Test Recording #32 but using end edit point] 64 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or"Tagged" values
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 23" FILE, DELETE IT FROM THE IPHONE/IPOD TOUCH, RE-NAME THE UNMODIFIED "TEST FOR OVERWRITE 23" TO "...24" & TRANSFER IT FROM THE COMPUTER TO THE IPHONE/IPOD TOUCH "VOICE MEMOS" APP (OR VIA OTHER METHOD).
ALTERED & DISCONTINUOUS (OVERWRITE FILE) 24 At least one dav after Test Recording #8 made above, choose the transferred "TEST FOR OVERWRITE 24" recording, select "Edit", click on icon for selecting edit points, move start edit point to *20-second point and end edit point to *40-second point so that recording length shows *20 seconds, select "Trim" (keeps these 20 seconds of the recording), select "Delete From Original" (resulting file will have the same name) 64 kbps, inconsistent record and encode dates Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or"Tagged" values
DOWNLOAD MODIFIED "TEST FOR OVERWRITE 24" FILE.
Page 7 of 7
53


APPENDIX C
TEST RECORDING COLLECTION PROTOCOL iOS 6
IPHONE/IPOD TOUCH VOICE MEMOS
TEST RECORDING PROTOCOL
DOCUMENT THE FOLLOWING INFORMATION BEFORE PRODUCING TEST RECORDINGS:
iPhone/iPod Touch model number (via visual inspection of model number on back cover) (e.g.,
"A1522"). Cross reference with the following: o iPhone:
https://support.apple.com/en-us/HT201296
http: //www.apple.com/iphone/LTE/ (as needed) for LTE & country confirmation
http://www.everyi.com/by-identifler/ipod-iphone-ipad-specs-by-model-number-family- number.html
o iPod Touch:
https://support.apple.com/en-us/HT204217
http://www.everyi.com/by-identifler/ipod-iphone-ipad-specs-by-model-number-family- number.html
iPhone/iPod Touch "Model (via Settings/General/About/Model) (e.g., "MGAU2LL/A; refers to model, carrier, capacity,
& color) [TAKE SCREEN SNAP]. Cross reference with the following: o Apple Devices by Order Number: http://www.everyi.com/by-identifler/ipod-iphone-ipad- specs-bv-apple-
order-number-part-number.html
o iPhone 6S Model Numbers: http://leimobile.com/iphone-6s-model-numbers/ iPhone/iPod Touch serial number (via Settings/General/About/Serial Number) [TAKE SCREEN SNAP]
54


iOS version (via Settings/General/About/Version) [e.g., "9.2.1 (13D15)] [TAKE SCREENSNAP]
"Voice Memos default recording name for next recording, if known. "New Recording # is the default naming convention, with "# being a numerical value that increments with each new recording. Note that "# will be next numerical value for which no recording exists and may be out of chronological order. For example, if "New Recording 1,
"New Recording 3, and "New Recording 4 exist, the next recording will be "New Recording 2" and then "New Recording 5" after that.
55


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH iPhone 4 (A1332) iOS 6.1.3 (10B32911
STATE # DESCRIPTION EXPECTED OUTPUT REASON(S)
o u 1 2 3 Continuous, 1-minute recording with "Stop" pressed as quickly as possible in sequence at the end of the recording 64 kbps, record dates not present Time/frequency characteristics of pause stop/start events
4 Continuous, 1-minute recording with "Pause" pressed to end the recording, then "List" pressed one minute later in sequence
5 (iPhone only) Begin recording, call iPhone from landline or other mobile device (recording pauses automatically, note length of recording when paused), let call go to voicemail, press "Done" & "Save" as quickly as possible when the "Voice Memos" app screen returns to close out the recording
6 Begin recording, perform pause stop/start events, three times each (1) with no vocal buzzing into or out of pause event, (2) with vocal buzzing into pause event, (3) with vocal buzzing out of pause event, & (4) with vocal buzzing into and out of pause event, stop recording
7 Begin recording for one minute, perform pause event, leave paused for two minutes, resume recording for one minute, "Stop" pressed as quickly as possible in sequence at the end of the recording 64 kbps, record dates not present Note differences between calculated recording length ("Encoded"/"Tagged" value minus "Recorded" value) and actual length of recording
8 Begin recording for one minute, perform pause event, leave paused for two minutes, resume recording for one minute, "Pause", then "List" pressed minute later to end the recording 64 kbps, record dates not present Note differences between calculated recording length ("Encoded"/"Tagged" value minus "Recorded" value) and actual length of recording
56


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH iPhone 4 (A1332) iOS 6.1.3 (10B329)]
STATE # DESCRIPTION EXPECTED OUTPUT REASON(S)
o =1 z z 9 Begin recording for one minute, perform pause event, leave paused for two minutes, resume recording for one minute, "Pause", "List" pressed to end the recording 64 kbps, record dates not present Note differences between calculated recording length ("Encoded"/"Tagged" value minus "Recorded" value) and actual length of recording
10 (iPhone only) Begin recording, call iPhone from landline or other mobile device (recording pauses automatically, note length of recording when paused), let call go to voicemail, resume recording when the "Voice Memos" app screen returns, record until total length of recording is two minutes, "Stop", "Done", & "Save" pressed as quickly as possible in sequence at the end of the recording
o u device, only one time each (total of four calls for vocal buzzing combinations), time/frequency characteristics of incoming
11 decline calls to speed up the process 64 kbps, record dates not present call stop/start events
DOWNLOAD TEST RECORDINGS 1-H1
At least one dav after Test Recording#! made above, select "Edit", click on icon for
selecting edit points, move start edit point to =20-second point so that recording Basic metadata/file structure,
12 length shows =40 seconds, select "Trim" (keeps last 40 seconds of the recording), 64 kbps, record dates not present time/frequency characteristics of incoming
select "Save As New Recording" call stop/start events
At least one dav after Test Recording #2 made above, select "Edit", click on icon for
selecting edit points, move end edit point to =20-second point so that recording Basic metadata/file structure,
13 length shows =20 seconds, select "Trim" (keeps first 20 seconds of the recording and 64 kbps, record dates not present time/frequency characteristics of incoming
removes last 40 seconds) call stop/start events
57


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH iPhone 4 (A1332) iOS 6.1.3 (10B329)]
STATE # DESCRIPTION EXPECTED OUTPUT REASON (S)
14 At least one dav after Test Recording #3 made above, select "Edit", click on icon for selecting edit points, move start edit point to ~20-second point and end edit point to *40-second point so that recording length shows *20 seconds, select "Trim" (keeps these 20 seconds of the recording) 64 kbps, record dates not present Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or "Tagged'1 values
DOWNLOAD TEST RECORDINGS 12-14
15 At least one dav after Test Recording #8 made above. Click on icon for selecting edit points, move start edit point to 20-second point so that recording length shows *1:40 seconds, select "Trim" (keeps last 40 seconds of the recording) 64 kbps, record dates not present Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or "Tagged'1 values
16 At least one dav after Test Recording #9 made above. Click on icon for selecting edit points, move end edit point to 20-second point so that recording length shows *20 seconds, select "Trim" (keeps first 20 seconds of the recording and removes last 1:40 seconds) 64 kbps, record dates not present Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or "Tagged'1 values
17 At least one dav after Test Recording #9 made above, select "Edit", click on icon for selecting edit points, move start edit point to 20-second point and end edit point to *40-second point so that recording length shows *20 seconds, select "Trim" (keeps these 20 seconds of the recording) 64 kbps, record dates not present Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or "Tagged'1 values
58


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH iPhone 4 (A1332) iOS 6.1.3 (10B329)]
DOWNLOAD RECORDINGS 15-17. COPY THE DOWNLOADED TEST RECORDING #1 ABOVE TO A NEW FILE NAMED "TEST FOR OVERWRITE 17" ON THE COMPUTER. TRANSFER FILE TO VOICE MEMOS APP USING iTUNES METHOD.
STATE # DESCRIPTION EXPECTED OUTPUT REASON(S)
ALTERED (OVERWRITE 18 At least one dav after Test Recording #1 made above, choose the transferred "TEST FOR OVERWRITE 18" recording, select "Edit", click on icon for selecting edit points, move start edit point to =20-second point so that recording length shows ~40 seconds, select "Trim" (keeps last 40 seconds of the recording) 64 kbps, record dates not present Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or "Tagged" values
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 18" FILE, DELETE IT FROM THE IPHONE/IPOD TOUCH, RE-NAME THE UNMODIFIED "TEST FOR OVERWRITE 18" TO "...19" & TRANSFER IT FROM THE COMPUTER TO THE IPHONE/IPOD TOUCH "VOICE MEMOS" APP (OR VIA OTHER METHOD).
ALTERE D 19 At least one dav after Test Recording #1 made above, choose the transferred "TEST FOR OVERWRITE 19" recording, select "Edit", click on icon for selecting edit points, move end edit point to =20-seeond point so that recording length shows =20 seconds, select "Trim" (keeps first 20 seconds of the recording and removes last 40 seconds) 64 kbps, record dates not present Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or '"Tagged values
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 19" FILE, DELETE IT FROM THE IPHONE/IPOD TOUCH, RE-NAME THE UNMODIFIED "TEST FOR OVERWRITE 19" TO "...20" & TRANSFER IT FROM THE COMPUTER TO THE IPHONE/IPOD TOUCH "VOICE MEMOS" APP (OR VIA OTHER METHOD).
59


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH iPhone 4 (A1332) iOS 6.1.3 (10B329)]
STATE # DESCRIPTION EXPECTED OUTPUT REASON(S)
ALTERE D 20 At least one dav after Test Recording #1 made above, choose the transferred "TEST FOR OVERWRITE 20" recording, select "Edit", click on icon for selecting edit points, move start edit point to 20-second point and end edit point to 40-second point so that recording length shows *20 seconds, select "Trim" (keeps these 20 seconds of the recording) 64 kbps, record dates not present Basic metadata/file structure, note changes to "Recorded", "Encoded", and/or 'Tagged' values
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 20" FILE
COPY THE DOWNLOADED TEST RECORDING #8 ABOVE TO A NEW FILE NAMED "TEST FOR OVERWRITE 21" ON THE COMPUTER. IMPORT NEW FILE INTO iTUNES. RIGHT CLICK ON FILE AND SELECT "GET INFO". CLICK ON "OPTIONS" TAB ON MENU THAT POPS UP. UNDER "MEDIA KIND" SELECT "VOICE MEMO" AND PRESS "OK". DRAG FILE ONTO PHONE TO IMPORT VOICE MEMO.
ALTERED & DISCONTINUOUS (OVERWRITE FILE) 21 At least one dav after Test Recording #8 made above. Click on icon for selecting edit points, move start edit point to *20-second point so that recording length shows *1:40 seconds, select "Trim" (keeps last 40 seconds of the recording) 64 kbps, record dates not present Basic metadata/file structure, note change: to "Recorded", "Encoded", and/or "Tagged values
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 21" FILE, DELETE IT FROM THE IPHONE/IPOD TOUCH, RE-NAME THE UNMODIFIED "TEST FOR OVERWRITE 21" TO "...22" & TRANSFER IT FROM THE COMPUTER TO THE IPHONE/IPOD TOUCH "VOICE MEMOS" APP (OR VIA OTHER METHOD).
60


PROPOSED IPHONE/IPOD TOUCH "VOICE MEMOS"
TEST RECORDING PROTOCOL
SEQUENCE OF TEST RECORDINGS [DEVELOPED WITH iPhone 4 (A1332) iOS 6.1.3 (10B329)]
ALTERED & DISCONTINUOUS (OVERWRITE 22 At least one dav after Test Recording #8 made above. Click on icon for selecting edit points, move end edit point to ~20-second point so that recording length shows ~20 seconds, select "Trim" (keeps first 20 seconds of the recording and removes last 40 seconds) 64 kbps, record dates not present Basic metadata/file structure, note change: to "Recorded", "Encoded", and/or "Tagged values
STATE # DESCRIPTION EXPECTED OUTPUT REASON(S)
DOWNLOAD THE MODIFIED "TEST FOR OVERWRITE 22" FILE, DELETE IT FROM THE IPHONE/IPOD TOUCH, RE-NAME THE UNMODIFIED "TEST FOR OVERWRITE 22" TO "...23" & TRANSFER IT FROM THE COMPUTER TO THE IPHONE/IPOD TOUCH "VOICE MEMOS" APP (OR VIA OTHER METHOD).
ALTERED & DISCONTINUOUS (OVERWRITE FILE) 23 At least one dav after Test Recording #8 made above. Click on icon for selecting edit points, move start edit point to 20-second point and end edit point to *40-second point so that recording length shows ~20 seconds, select "Trim" (keeps these 20 seconds of the recording) 64 kbps, record dates not present Basic metadata/file structure, note change: to "Recorded", "Encoded", and/or "Tagged values
DOWNLOAD MODIFIED "TEST FOR OVERWRITE 23" FILE
ALTERED & DISCONTIN 24 Re label Test Recording 1 as a "Podcast" 64 kbps, record dates not present Basic metadata/file structure, note change: to "Recorded", "Encoded", and/or "Tagged values
61


APPENDIX D
DECISION TREE
62


APPENDIX E
DECISION TREE iOS 4-6
63


APPENDIX F
DECISION TREE iOS 7
64


APPENDIX G
DECISION TREE iOS 10
65


A
YES
Does the "Recorded Date" and its time differential from "Encoded Date" fit the details of the case?
-NO-
__________________>jr_____________
Are indications of incoming calls or pauses made during ^ the recording present?
CONSISTENT with original, continuous, unaltered iPhone, VoiceMemos app recording made on "Recorded Date". However, may be discontinuous due to short pause(s) not detectable by date/time differential. Further analysis needed.
NOT CONSISTENT with an original, continuous, unaltered iPhone,
VoiceMemos app recording.
Hypothesis 1. Has been edited on iPhone using "Delete From Original" on the "Encoded Date". Original date/time of recording is "Recorded Date"
Hypothesis 2. Lengthy pauses made during recording. Further analyses required.
Possible to be CONSISTENT with original, continuous, unaltered iPhone, VoiceMemos app recording made on the Record Date if time between pressing Done and Save was lengthy. Further analyses required.
Obtain call records. Does ( Duration of Evidence Audio ) + ( Duration of Phone Call(s) from Call Record ) = ("Encoded Date") ("Recorded Date")'
NOT CONSISTENT with original, continuous, unaltered iPhone, VoiceMemos app recording. Discontinuous due to incoming call(s). Further analysis required.
NOT CONSISTENT with original, continuous, unaltered iPhone, VoiceMemos app recording. Discontinuous due to incoming call(s). In addition:
Hypothesis 1. Has also been edited on iPhone using "Delete From Original" on the "Encoded Date". Original date/time of recording (or over recording) is "Recorded Date" Further analyses required. Hypothesis 2. Lengthy pauses made during recording. Further analyses required. Hypothesis 3: Discontinuous due to incoming call(s) if time between pressing Done and Save was lengthy. Further analysis required.
NOT CONSISTENT with an original, continuous, unaltered iPhone, VoiceMemos app recording.
Hypothesis 1: On the "Encoded Date" portion(s) in the middle deleted using iPhone and saved to overwrite original. Original date/time of recording (or over recording) is "Recorded Date". Further analysis required.
Hypothesis 2: Over-recorded on "Recorded Date" Further analyses required.
66


APPENDIX H
DECISION TREE iOS 11
67


A
Does the "Recorded Date" and its time differential from "Encoded Date" fit the details of the case?
CONSISTENT with original, continuous, unaltered iPhone, VoiceMemos app recording made on "Recorded Date". However, may be discontinuous due to short pause(s) not detectable by date/time differential. Further analysis needed.
NOT CONSISTENT with an original, continuous, unaltered iPhone,
VoiceMemos app recording.
Hypothesis 1. Has been edited on iPhone using "Delete From Original" on the "Encoded Date". Original date/time of recording is "Recorded Date"
Hypothesis 2. Lengthy pauses made during recording. Further analyses required.
Possible to be CONSISTENT with original, continuous, unaltered iPhone, VoiceMemos app recording made on the Record Date if time between pressing Done and Save was lengthy. Further analyses required.
_______________Y_____________
Are indications of incoming calls or pauses made during the recording present?
Obtain call records. Does ( Duration of Evidence Audio) + ( Duration of Phone Call(s) from Call Record ) = ("Encoded Date") ("Recorded Date") ?
NOT CONSISTENT with original, continuous, unaltered iPhone, VoiceMemos app recording. Discontinuous due to incoming call(s). Further analysis required.
NOT CONSISTENT with original, continuous, unaltered iPhone, VoiceMemos app recording. Discontinuous due to incoming call(s). In addition:
Hypothesis 1. Has also been edited on iPhone using "Delete From Original" on the "Encoded Date". Original date/time of recording (or over recording) is "Recorded Date" Further analyses required. Hypothesis 2. Lengthy pauses made during recording. Further analyses required. Hypothesis 3: Discontinuous due to incoming call(s) if time between pressing Done and Save was lengthy. Further analysis required.
NOT CONSISTENT with an original, continuous, unaltered iPhone, VoiceMemos app recording.
Hypothesis 1: On the "Encoded Date" portion(s) in the middle deleted using iPhone and saved to overwrite original. Original date/time of recording (or over recording) is "Recorded Date". Further analysis required.
Hypothesis 2: Over-recorded on "Recorded Date" Further analyses required.
68


Full Text

PAGE 1

ANALYSIS OF AUDIO RECORDINGS MADE USING VOICE MEMOS APPLICATION FOR i OS by ANDREW ROBERT HILL B.S., University of Colorado Denver, 2014 A thesis submitted to the Faculty of the Graduate School of the University of Colorado in partial fulfillment of the requirements for the degree of Master of Science Recording Arts Program 2017

PAGE 2

ii 2017 ANDREW ROBERT HILL ALL RIGHTS RESERVED

PAGE 3

iii This thesis for the Master of Science degree by Andrew Robert Hill has been approved for the Recording Arts Program by Catalin Grigoras, Chair Jeffrey Smith Scott Burgess December 16, 2017

PAGE 4

iv Hill, Andrew Robert (M.S. Recording Arts Program ) Analysis of Audio Recordings Made Using Voice Memos Application For iOS Thesis directed by Associate Professor Catalin Grigoras ABSTRACT This thesis will discuss the current challenges and previous research done when analyzing audio recordings created b y the Voice Memos application for iPhone. An overview of what the Voice Memos application is and the different ways it can create and edit audio recordings will be discussed. How audio files are made and the different aspects of their files and structure will be also be discussed as it relates to the characteristics of Voice Memo recordings. This paper will also expand on and present an updated version of a test recording collection protocol used to collect data from Voice Memos. The new test recording protocol was also used to gather new data from Voice Memos. New findings found from these test recordings will be discussed, as well as new findings in the latest version of iOS. New data will also be u sed to present an updated Voic e Memos recording decision tree, which aims to help quickly analyze audio recordings to see if they're consistent with Voice M emo recordings, and if so, their congruency with an unaltered audio file or one that has been edited or altered with the Voice Memos app. The form and c ontent of this abstract are approved. I recommend its publication. Approved: Catalin Grigoras

PAGE 5

v ACKNOWLEDGEMENTS I would like to acknowledge my professors Catalin Grigoras and Jeff Smith for all their help with my thesis and all their help throughout my entire graduate education. I would also like to thank Scott Burgess for taking time out of his schedule and agreeing to be my third thesis committee member. Furthermore, I would also like to thank Doug Lacey and Bruce Koenig for their prev ious research into Voice Memos, which gave my thesis a starting point.

PAGE 6

vi TABLE OF CONTENTS CHAPTER I. INTRODUCTION ................................ ................................ ................................ .......... 1 C HALLENGES ................................ ................................ ................................ ................ 3 P REVIOUS R ESEARCH ................................ ................................ ................................ ... 4 II. VOICE MEMOS USE R INTERFACE ................................ ................................ ......... 7 I OS 7 ................................ ................................ ................................ .......................... 10 I OS 11 ................................ ................................ ................................ ........................ 12 III. BACKGROUND ON DIGITAL AUDIO ................................ ................................ 14 S AMPLING R ATE ................................ ................................ ................................ ......... 14 B IT R ATE ................................ ................................ ................................ .................... 15 F ILE F ORMATS ................................ ................................ ................................ ............ 16 A TOM S TRUCTURE ................................ ................................ ................................ ..... 17 IV. TEST RECORDING COLLECTION PROTOCOL ................................ ................. 19 U PDATES TO THE O RIGINAL T EST R ECORDING P ROTOCOL ................................ ......... 20 V. NEW FINDINGS ................................ ................................ ................................ ........ 24 I OS 11 ................................ ................................ ................................ ........................ 25 T EST R ECORDINGS ................................ ................................ ................................ ..... 25 VI. CONCLUSION ................................ ................................ ................................ .......... 29 F UTURE R ESEARCH ................................ ................................ ................................ .... 29 REFERENCES ................................ ................................ ................................ ................. 31

PAGE 7

vii APPENDIX A. TEST RECORDING C OLLECTION PROTOCOL I OS 10 11 ................................ 33 B. TEST RECORDING C OLLECTION PROTOCOL I OS 7 ................................ ........ 46 C. TEST RECORDING C OLLECTION PROTOCOL I OS 6 ................................ ........ 54 D. DECISION TREE ................................ ................................ ................................ ....... 62 E. DECISION TREE IO S 4 6 ................................ ................................ .......................... 63 F. DECISION TREE IO S 7 ................................ ................................ ............................. 64 G. DECISION TREE IO S 10 ................................ ................................ ........................... 65 H. DECISION TREE IO S 11 ................................ ................................ ........................... 67

PAGE 8

viii LIST OF FIGURES Figure 1: Voice Memos app icon ................................ ................................ ........................ 2 Figure 2: Original Voice Memos interface ................................ ................................ ......... 8 Figure 3: Voice Memos recording ................................ ................................ ...................... 8 Figure 4: Renaming recordings ................................ ................................ .......................... 9 Figure 5: Trimming a recording ................................ ................................ ......................... 9 Figure 6: New interface in iOS 7 ................................ ................................ ...................... 10 Figure 7: Trim editing in iOS 7 ................................ ................................ ........................ 12 Figure 8: Different atom types ................................ ................................ .......................... 18 Figure 9: File type atom viewable in metadata ................................ ................................ 18 Figure 10: How to categorize a file as a Voice Memo in iTunes ................................ ..... 22 Figure 11: Example of a file hash ................................ ................................ ..................... 22 Figure 12: iOS version in metadata ................................ ................................ .................. 24

PAGE 9

1 CHAPTER I INTRODUCTION The iPhone was firs t introduced on January 9, 2007 and has gone on to sell millions and millions of phones all over the world since it's initial release Just last year (2016), Apple sold almost 212 millions phones worldwide [1] With the popularity and widespread use of iPhones and other smart phones, people now own a device that they can have on them at all times and take with them anywhere. A device that can easily carry out various different task s such as taking pictures, mak ing phone calls, checking email and making video/audio recordings In 2009 iPh one OS 3 was released by Apple an update to the current iPhone operating system to add improvements and more functionality to their current iPhones, iPads, and iPod Touches [2] One of the new features this operating system included was a new app lication called Voice Memos. The Voice Memos application uses the devices microphone to record audio. After a user makes a recording, they can use the app to share their recording via email, text, or by syncing the device through Apple's desktop iTunes a pplication The first version of Voice Memos also allowed users to make edits to recordings with a trimming feature that could be used to shorten the beginning or the end of recordings. Later updates to Voice Memos added more recording and editing capabi lities.

PAGE 10

2 Figure 1 : Voice Memos app icon This paper aims to explore the possibilities present when recording and editing audio using the Voice Memos application, as well as observing the characteristics of these recordings. Recordings were made across different versions of Apple 's mobile operating system, iOS (iPhone Operating System) which included three different versions of Voice Memos. A testing protocol presented at AES [4] was augmented to incorporate additional iOS versions. This p rotocol is based off of the different ways you can use Voice Memos to create and edit recordings and was used to guide the creation of the test recordings. The characteristics of the tested audio recordings were compared with recordings from different versions of iOS to see what similarities and differences were present. Edited/altered recordings were also compared to original recordings in order to see how manipulated recordings predictably deviated from the originals. The observations were then added to a decision tree that was previously presented at AES and also used to make separate decision trees for different versions of iOS The purpose of the decision tree is to create a quick way for someone to examine the traits of a recording and determine based on traits in the examined recording if the recording is consistent with known rec ordings with known states (over recorded, tri mmed, phone call interrupted, etc.) from iOS Voice Memo s or isn't.

PAGE 11

3 Challenges With th e widespread use of smart phones it's been inevitable that smart phones would start to become a bigger part of pol ice investigations Data stored on phones such as call s, texts, email s etc. has the potential to become evidence. Experts in the field of mobile phone and audio forensics have also noticed an increase in the amount of audio recording evidence coming from smart phones. Often time, before an audio recording can be analyzed for the content heard on the recording the authenticity of the recording needs to be determined. The Scientific Working Group on Digital Evidence (SWGDE) defines an audio authentication examination as one that "seeks t o determine if a recording is consistent with the manner in which it is alleged to have been produced" [3 ]. Now more then ever before, there's an abundance of audio editors available that make changing an audio recording very simple. This makes it very e asy to challenge the authenticity of audio recording evidence that is used in trials. The more we know about what audio recordings from a device such as a smart phone look like and what their characteristics are the easier it is to determine a recording s authenticity. Another challenge of looking at audio recordings is that audio recordings often have similar characteristics Using a computer you can easily view the traits audio recordings have, file format, file size, sampling rate bit rate, lengt h of recording. A lot of these traits are similar between recording devices and don't help identify exactly which device created a recording or how it was created A lot of recording devices also allow users to edit an audio recording. Looking at the traits of a recording, it can be hard to identify if a device has edited a recording or not.

PAGE 12

4 Further authenticity examination can help determine if edits are present in a recording or not. Identifying edits made by audio editors isn't usually too challenging but identifying if an app like Voice Memos made edits to a recording is harder to determine Previous Research The decision tree developed to analyze audio recordings and that will also be discussed in more detail later in this thesis, was first presented at the annual AES (Audio Engineering Society) conference in June 2017. The presentation, "Triage Approach for the Forensic Analysis of Apple iOS Audio Files Recorded Using the Voice Memos' App" discussed the decision tree and how it was develop ed and first tested by Jeff Smith, Douglas Lacey, Bruce Koenig, and Catalin Grigoras [4 ] The decision tree was created based on observations of some of the main traits of audio recordings that were created with Voice Memos. These traits include the en coded audio type and the bit rate. The atom structure of files was also used to observe specific characteristics of the files such as the size of the data user atom. Some of these traits also help to distinguish between different vers ions of iOS that created the audio recording. It's also important to note that when analyzing an audio recording from an iPhone, knowing which version of iOS is helpful as it can be used to distinguish between different audio files but knowing the iPhone s model that created the recording is useless It may be helpful during an investigation for the police to connect a recording made on a phone to a suspect who owns that same phone model but for discussing the analysis of Voice Memos audio recordings, the model that created the phone isn't important. To initially test the accuracy and repeatability of the decision tree, one of the authors of "Triage Approach for the Forensic Analysis of Apple iOS Audio Files

PAGE 13

5 Recorded Using the Voice Memos' App" created t wenty audio recordings that were then sh ared t o the other three authors to test the decision tree blindly and independently of each other These .m4a files consisted of seventeen (17) recordings made using the iPhone/iPod Touch "Voice Memos" app, in differing states of originality, continuity, and alteration; two (2) original, continuous, and unaltered recordings made using third party iPhone audio recording apps; and one (1) "Voice Memos" app recording re encoded and saved using GoldWave audio editin g software [4 ]. Renaming recordings within the "Voice Memos" app has also already been found to not change the file content so files used for testing the decision tree were renamed "TEST FILE 01.m4a" through "TEST FILE 20.m4a" to eliminate any bias that could've been introduced by the original file names of the recordings. Test results from the authors using the decision tree helped update the version of the decision tree that was presented at AES. The testing helped illuminate the problems of having c lear language to make the examiner s decisions consistent as well as further information that needed to be included in the decision tree. Interpreting encoded and recording dates in the audio recordings file information was also found to be an area of inc onsistency. While this information can be crucial in detecting discontinuities and alterations made with the "Voice Memos" app, the variables affecting these dates are derived from activities which result in both original, continuous files as well as ori gi nal, discontinuous files making discrimination between the two difficult. Therefore, care must be exercised in interpretin g t hese data fields in practice" [4 ]. It's important to remember with the decision tree that the purpose of it is to be another tool for helping with the authentication process. It's meant to be a quick guide

PAGE 14

6 for determining if a recording is consistent with known iOS Voice Memos recording s or not An examiner should never only use the decision tree and should always conduct a co mplete and thorough authentication examination. The decision tree is an ideal starting point in the authentication process for an audio recording suspected of being made with the Voice Memos app With each new iOS release new testing will have to be done so the decision tree can be expanded upon with new information. Should new features be added into the Voice Memos app the testing protocol for gathering data for the decision tree will also have to be updated.

PAGE 15

7 CHAPTER II VOICE MEMOS USER INTERFACE Voice Memos was first introduced on the iPhone on June 17, 2009 through the iPhone OS 3 update [5 ] Voice Memos uses the device s microphone to record audio or if the device doesn't have a microphone, an external microphone or headphones with a microphone can be plugged into the headphone jac k and Voice Memos will use the external microphone to record audio. This is the only way Voice Memos can record on the iPod Touch which doesn't have a microphone built into the device The first version of Voice Me mos allowed a user to make recordings by starting a recording and stopping it or a recording could be paused, then continued and stopped or paused again Recordings were automatically named with the date and time the rec ording was made but could be re name d with preset names such as "Podcast" or with a custom name The first version of Voice Memos also allowed a user to "trim" the recording by removing the beginning or the end to change what time in the original recording the playback would start or stop Once recordings are made they can be synced to an iTunes library or shared directly from the app. If a user wants to extract their recordings from Voice Memos to a computer, they can use iTunes, Apples application for media playback and device management A user would connect their iPhone to their computer and allow iTunes to synchronize with the device. iTunes would then automatically import and sort the recordings into its media library. A user could also share r ecordings by email or text directly from Voice Memos.

PAGE 16

8 Figure 2 : Original Voice Memos interface Figure 3 : Voice Memos recording

PAGE 17

9 Figure 4 : Renaming recordings Figure 5 : Trimming a recording

PAGE 18

10 iOS 7 The next major update to Voice Memos came on September 18, 2013 when iOS 7 was released [6 ] The new Voice Memos app featured a new interface and introduced more options for recording and editing. Th e interface showed the waveform of the audio being recorded and played backed instead of the microphone and VU meter. Recordings were stored and categorized o n the same screen as the rest of the interface under the top portion of the ap p where the waveform is shown Figure 6 : New interface in iOS 7 In iOS 7, recordings are made the same way by pressing record and then you have the option to pause recording then continue recording or to stop. To stop a recording, the user presses "done", the n the u ser is prompted to name the recording instead of the app automatically saving the recording with the date and time of the recording If a user

PAGE 19

11 doesn't input a custom name, r ecordings will be automatically named as "New Recording" with newer recordings nam ed by New Recording 2 "New Recording 3", etc If a user was recording and exited the app to return to the home screen, a red bar would appear on the top of the device screen showing that recording was still taking place in the background. You could also pause in the middle of a recording and scroll back to an earlier section of the recording and continue recording from that section and record over the subsequent part of the recording. Recordings could also be deleted by swiping towards the left on the desired recording and a "delete" tab would appear next to the recording. The same editing features were also available for the iOS 7 version of Voice Memos as were previously available When a user selects a recording, they have the option to edit by pressing the "edit" button that appears next to the share button and the delete icon. Once "edit" is pressed, the waveform of the selected recording will appear in the upper section of the app and the user can then press a cropping icon that brin gs up the trim option. Like the previous version of Voice Memos, t wo selection bar s will appear that allow the user to change when the recording starts or ends. In this version of Voice Memos, any trim edits made will automatically be applied over the or iginal recording.

PAGE 20

12 Figure 7 : Trim editing in iOS 7 Another new way of sharing Voice Memos recording was also introduced in iOS 7, Airdrop. Airdrop allows for file sharing between iOS devices or Mac computers using Wi Fi and Bluetooth connections. Devices have to be in close proximity to each other in order for Airdrop to work. Once a file is sent through Airdrop, the user receiving a file will be prompted on their device to accept the file being sent. Besides Airdrop, in iOS 7 you can share Voice Memos recordings by email, text, or synching the device with iTunes. iOS 11 The current version of Voice Memos hasn't changed much over the last few new iOS releases. The interface is exactly the same as it w as in i OS 7 but allows for a few new options The options for making recordings (record, pause, record, stop, done, save) are the same but at least since iOS 10 users can select an already existing recording and record over any part of it.

PAGE 21

13 A new editin g feature "delete" is also available. When you select a recording and press "edit" and then press the crop button, the red bars that appear can be used to make a selection of the recording then you can choose to delete the audio in between the red bars i nstead of trimming what's to the left and right of the bars. When making edits, you can now also choose to save an edited recording as a new recording or save over the original recording. If a user chooses to save an edited recording as a new recording, the recording name will stay the same but "copy" will be added to the recording name followed by "copy 2" "copy 3" for each consecutive recording. The current version of Voice Memos allows for the same sharing and exporting options for the recordings, s ynching with iTunes, Airdrop, email, and text. It's also important to note that Voice Memos has never given users options to change the recording settings or recording quality settings. These settings are all automatic and built into the app. The differ ent aspects of the recordings and the settings used to make them will be covered in the next chapter.

PAGE 22

14 CHAPTER III BACKGROUND ON DIGITAL AUDIO To further discuss audio recordings made with Voice Memos, it's important to understand some of the characteristics of digital audio recordings. It's also important to understand how the recordings are made and structured. This chapter will discuss audio and its traits so the later chapters talking about the unique features of Voice Memos recordings can be understood clearly. A whole paper could be written about how digital audio recordings are made and all the different aspects of them. To keep things simple, this section will discuss the different characteristics of audio that will relate to discussing the characteristics of recordings from Voice Memos. The New Oxford American Dictionary defines sound as "vibrations that travel through the air or anoth er medium and can be heard when they reach a person's or animal's ear". When sound is recorded, it can be recorded with analog technology/methods or by digital technology/methods. For analog recording the sound is captured through a microphone and physic ally recorded to tape that can then be read and played back to hear what was recorded. For digital recording sound is sampled at certain intervals and converted into numbers that can be read and stored by a digital device (computer, smart phone, digital r ecorder). One property of digital audio is its sampling rate Sampling Rate The sampling rate determines how many times a second a sound being recorded is captured so it can be represented digitally. The sampling rate is measured in hertz (Hz)

PAGE 23

15 or kilohe rtz (kHz). The higher the sampling rate the higher the maximum frequency (pitch) that can be sampled (recorded) The most commonly used sample rate for CDs and digital audio is 44,100 Hz or 44.1 kHz. This means that the digital recorder sampled each se cond of an audio recording 44,100 times to capture the audio. If a sampling rate is too low it can create problems in the audio that is recorded. The Nyquist Theorem states that a sampling rate should be at least double the rate of the highest frequency of audio being recorded [7 ] The highest frequency in this case refers to the highest pitch being he ard in a sound being recorded. The frequency range of human hearing is usually defined as 20 Hz to 20,000 Hz [8 ] Sounds towards the lower end of the hearing range would be a trucks engine or the lowest notes on a piano. Sounds towards the higher end of the hearing range would be birds chirping or the highest notes on a piano. How loud these sounds are doesn't affect the pitch of them. So if we want to make sure we capture all the sounds our ears can hear, we need to be able to record sounds up to 20,000 Hz. Following the Nyquist Theorem, the sampling rate should always be at least 40,000 Hz. This is where the standard of 44,100 comes from. Bit Rate The bit rate is another important aspect of a digital recording that determines the overall quality. The bit rate refers to how much information is being stored in the digital file itself. For audio files, it s usually referred to as kilobits per second (kbps). For example, songs downloaded from the iTunes store are usually 256 kbps. This means that when that song is played back, 256,000 bits of information are played back per second Like with the sampling rate, the higher the bit rate the more accur ate and better overall

PAGE 24

16 quality the file will be. The higher the kbps the more space the file will also take up on a storage device such as a computer or smart phone A digital audio file will have a constant bit rate if it was encoded (written) with a constant bit rate such as 256. Files can also be encoded with a variable bit rate where the bit rate will fluctua te throughout the audio file If you look at the information of a file with a variable bit rate, you will most likely see an average bit rate displayed. File Formats Once audio has been recorded, it has to be stored somehow and be readable by devices so the audio can be played. Audio file formats store the digital audio data and allow files to be organized and played using media players. Man y different audio file formats exist and offer different options. Some formats are lossless meaning they keep the entire original raw audio data, which creates big file sizes. Other formats are lossy meaning they remove information from the raw audio dat a to compress the file size. Lossy compression formats also affect the quality of the audio stored in the files Sometimes these compressed audio files won't sound any different to a listener while files that have been drastically compressed might have a more noticeable smaller thinner duller sound to them. Digital a udio files are made up of two important parts, t he con tainer and the codec. The codec states the method in which the data it contains should be encoded (written) and decoded (played back). The container "packages" the codec and makes it understandable to a digital system. The container is also often the extension you see at the end of files such as .wav, a wave file format.

PAGE 25

17 A good analogy to help make this concept of containers and codecs more easily understood i s to think of a can of soup. In this case the container is the outside of the soup can it has a label and list of ingred ients to tell you what 's in it what it contains and how it should be handled The codec is then the soup itself. Some examples of containers are AIFF, WAV, M4A and some examples of codecs are FLAC, WMA, and MP3. Voice Memos recordings are AAC (advanced audio coding ) that are contained in a M4A (moving pictures group 4 audio) file Atom Structure All d igital files contain metadata, which is information the file contains about itself. Metadata can contain information about when the file was created, what hardware or software created the file, or user information that created the file. This data can als o be structured in a specific order th at makes it easier to analyze and locate certain information. M4A Voice Memo recordings adhere to the QuickTime File Format Specification that lays out exactly how and where data is stored in digital files. The data units in a QuickTime file are called atoms and are measured in bytes. Atoms also contain field types that describe what kind of data is stored in them [9 ] Figure 8 below shows some examples of atom types The field types are abbreviated to four letters versions of what the field type represents, such as "udta" which is short for "user data atom". The metadata and atoms of a file can be viewed with a file information viewer (such as MediaInfo [11] ) or a hex viewer (such as Hex Fiend [12] ) Figur e 9 shows an example of the ftyp atom seen using Hex Fiend. Other programs such a s Atomic Parsley [13] can be used to show where certain atoms are in the file and how big

PAGE 26

18 they are. For Voice Memos recordings the atoms of interest is the file type (ftyp), wide, movie header (mvhd), track header (tkhd), and the user data atom (udta). Figure 8 : Different atom types Figure 9 : File type atom viewable in metadata When analyzing audio recordings from Voice Memos, certain aspects of the files atom structure can also tell us which version of iOS created that file. The iOS version is usually easily viewable in the metadata. A lot more could be discussed regarding the process of recording, storing, and reading audio data Many other papers exist on those topics already and for the purposes of this paper, the information in this chapter should be sufficient to move on and discuss the important information related to au dio recordings from Voice Memos.

PAGE 27

19 CHAPTER IV TEST RECORDING COLLECTION PROTOCOL As discussed in chapter 2, there are many variables introduced by the user when making recordings with the Voice Memos app For example you can create a continuous one minute recording then press "stop", "done", "save" to finish making the recording. You could also make a continuous one minute recording then press ing "stop", "done", and press "save" a minute later. You could also pause the recording after a minute and start recording again a few minutes later then press "stop", "done", "save" To collect data from the audio recordings produced by Voice Memos, a testing protocol had to be developed. The testing protocol needed to make sure that all the data collected from V oice Memos would cover all the different ways and scenarios that a recording could be made from the app. A testing protocol for Voice Memos was first developed by Doug Lacey from Bek Tek LLC who was also one of the co authors of "Triage Approach for the Forensic Analysis of Apple iOS Audio Files Recorded Using the Voice Memos' app". This testing protocol was originally developed based on iOS 10 and was a great starting point t o gather data from Voice Memos. The first section of t he original testing protocol covered continuous recordings with different orders of pauses and different order of operations for the "stop", "done", "save" process It also covered receiving phone calls while Voice Memos was recordings. The protocol also covered making trim and deletion edits to recordings in Voice Memos with six different combinations made to original recordings then saved as copies of the original recordings The editing

PAGE 28

20 combinations were trimming/deleting from the beginning, the e nd, and from the beginning and the end of recordings The last section of the original testing protocol had a user transferring original recordings back into Voice Memos using a third party program. Once a recording was back on the phone, a trim or dele tion edit was made and saved over the original recording. These edits were also trimming/deleting from the beginning, the end, and from the beginning and the end of the recordings Once a user has made all the test recordings, they repeat the testing pro tocol two more times so there's three total complete sets of data. The testing protocol also follows the Voice Memos automatic file naming "New Recording", "New Recording 2" and when making edits, "New Recording Copy", "New Recording Copy 2" etc The re cordings that are transferred back onto the device are then edited and saved over the original recordings and manually named as "Test For Overwrite 25" through "Test For Overwrite 36". This makes it easy to keep track of which recording files match which testing scenario. Updates to the Original Test Recording Protocol The original testing protocol was updated to make a few small changes and add some new options for types of recordings and a new way to transfer recordings back into Voice Memos. The origin al protocol included making ten continuous one minute long recordings with "stop", "done", "save" pressed as fast as possible to the end recordings. The updated testing protocol narrowed these types of test recordings down to just three instead of ten A column for "Expected Output" was also added to the protocol, showing what traits should be present in each test r ecording after they're made.

PAGE 29

21 The process of recording over original recordings was also added at the end of the protocol. Once a user has a ll the original recordings and all the edited recordings, they record again over all these recordings at different starting points One set of over recordings starting at the beginning of an original recording and recording new audio for ten seconds. A s econd set of over recordings starting somewhere in the middle of an original recording and recording new audio for ten seconds. And a third set of over recordings starting ten seconds before the end of a n original recording and recording new audio for twe nty seconds to go beyond the original length of the recording A new method was also found to transfer original recordings back into the Voice Memos app. Instead of using third party software, iTunes can be used to transfer recordings into Voice Memos. You can import any audio recording into iTunes, then right click on the recording and select "Get Info" or "Song Info". A new menu pops up with multiple tabs. Click on the "Options" tab. On this page there's a "media kind" section with a clickable pop down menu. On this menu you can tell iTunes what kind of recording the file is. One of the selections is "Voice Memo". Once "Voice Memo" is selected, you can press OK to apply the changes to the recording file. Now the file can be sync ed or manually transferred onto an iOS device where the recording will be imported into the Voice Memos app. This process is included in the updated testing protocol. Figure 10 below also shows how to categorize an audio file as a Voice Memo in iTunes.

PAGE 30

22 Figure 10 : How to categorize a file as a Voice Memo in iTunes To confirm this process didn't change anything about the recording files, test recordings were hashed, imported into iTunes and transferred to an iPhone. "Hashing" a file or generating its checksum is when a unique string of numbers and letters can be cre ated from the unique data present in a digital file using checksum software. This unique string of numbers and letters can be used to see if a digital file was changed during a transfer or download. If the data of a file is unchanged, the hash should als o be the same but if the file changes at all, the hash will be different. Figure 11 : Example of a file hash

PAGE 31

23 Once the test recordings were in the Voice Memos app, they were emailed from the app, downloaded and hashed again to s ee if the files had changed at all. The hash values were the same confirming that the process of transferring files to Voice Memos through iTunes didn't do anything to change the files. After going through the testing protocol and making all the recordi ngs in Voice Memos, the recordings can be collected by either emailing or airdropping directly from the app. The iPhone can also be synched with iTunes and all the Voice Memo recordings will be imported into the iTunes library. While the iTunes method is the quickest way to collect recordings, it also presents a challenge because while the recordings will appear in iTunes with the correct file names, the recordings are actually stored in a directory outside of iTunes where the filenames are labeled by the time/date. This makes it difficult to figure out exactly which recordings are which types of recording scenario. However, when files are emailed or airdropped they retain the correct file names. Once the test recording protocol was updated, it was also split into three different versions. Each protocol version covers a different version of Voice Memos and how it records/ makes edits differently from other versions of Voice Memos. So now there's a protocol for iOS 6 and previous a protocol for iOS 7 and a protocol for iOS 10 11. The newest version s of the test recording protocol s can be viewed in appendix A B and C

PAGE 32

24 CHAPTER V NEW FINDINGS Previous research has already helped us learn a lot about how Voice Memos makes audio recordings. Voic e Me mos saves recordings as AAC contained in a M4A format and records at 44.1 kHz and 64 kbps. When something in the recording file changes such as making a deletion edit from the middle of a recording the file needs to be re encoded (re created) and when this happens the file stays at 44.1 kHz but the bit rate changes to 256 kbps. The atom structures of files recorded on different versions of iOS are usually consistent with each other but they're a couple of differences that are unique to a specific iOS version. The ftyp atom is 28 bytes, the wide atom is 8 bytes, the mvhd atom is 108 bytes, and the tkhd atom is 92 bytes. These parts of the atom structure haven't been observed to change between different versions of iOS. However, the presence and size of the udta (user data) atom varies between different versions of iOS. For iOS 4 there is no udt a atom. For iOS 6 the udta atom is 250 bytes. For iOS 7 10 the atom size is 307 to 360 bytes. For iOS 10 the udta atom size varies based on if the file was edited. When the file is edited, the original record date is removed causing the udta atom to shrink Starting with iOS 7 the iOS version is reported in the metadata in the last set of bytes at the very end of the file as well and can be easily viewed with a hex viewer, such as Hex Fiend. iOS 4 6 doesn't report the iOS version in the metadata. Figure 12 : iOS version in metadata

PAGE 33

25 All this information was used to create a decision tree to help quickly look at a recording and see if it's consistent with known iOS Voice Memo recording data or not. When iOS 11 was released, new data was gathered from Voice Memos running on iOS 11 to add new data to a new decision tree just for iOS 11 New data collected from the test recording collection protocol was also used to make decision trees for the different versions of iOS that were tested iOS 10, iOS 7, and iOS 6 The new decision trees can be viewed in appendix D, E, F, G and H iOS 11 The current version of iOS i s iOS 11 released on September 19, 2017. iOS 11 brought a lot of new changes to the iPhone but no major changes to Voice Memos [10 ] The interface has remained the same and the recording/editing options have stayed the same. Voice Memos also still recor ds at 44.1 kHz and 64 kbps When recordings are edited and or re encoded such as a deletion the bit rate also changes to 256 kbps like it has in the past. For the first time since iOS 7 the atom structure has changes Th e wide atom has completely disappeared i n iOS 11 recordings. However, the size of the udta atom has stayed consistent with the size of udta atoms from iOS 7 10 307 360 bytes. Test Recordings The test recording collection protocol was used to collect data from a range of different versions of iOS. The iOS versions used for testing were 4.0, 4.0.2, 6.1.3, 7.1.1, 10.3.2, 10.3.3, and 11.0.2. The iPhone models used for testing were iPhone 6S, iPhone 4, iPhone 3G, and iPod Touch. A lot of the test recordings came out the way they were expected to with continuous recordings keeping the default sampling rate and bit rate.

PAGE 34

26 Recordings that were edited and re encoded also had a changed bit rate of 256 kbps as expected. One observation made on the test recordings was that when an edit was made to an original recording and then saved as a copy of that recording, the udta atom changed to a size of 307 bytes. This is because when the file is edited the original record date is removed. This was observed on test recordings from iOS 11 .0.2 1 0.3.3 and 10.3.2. However, with iOS 7.1.1 edits didn't change the size of the udta atom because the original record date wasn't removed and always stayed intact The udta a tom size on iOS 4 6 wasn't included by default and we don't know if the udta atom size changes on iOS 8 9 because they weren't available for testing Another observation made is that when an original recording had a section deleted from the middle of it, the bit rate changed from 64 kbps to 256 kbps. If sections were deleted or trimmed from the beginning or the end of the original recordings, the bit rate stayed the same at 64 kbps. Only when a section from the middle was deleted was a bit rate change noticed. It also didn't matter if the edited recordi ng was saved as a copy or saved over the original recording, the bit rate always changed with this type of deletion edit. This type of test recording could only be performed on iOS 11.0.2, 10.3.3, and 10.3.2 because the deletion option isn't available on a ny of the older versions of iOS that were available to test. Some of the test recordings also had a phone make a phone call to an iPhone that was already recording in Voice Memos. Voice Memos always paused recording when the iPhone received a call. When the call was ended, a user could continue recording or stop and save the recording. In cases where the recording was continued after the call

PAGE 35

27 ended, the bit rate of the file changed from 64 kbps to 256 kbps. This was the only instance in the test recordi ngs where a pause caused the bit rate to change; no manual pauses changed the bit rate in other test recordings. This type of test recording was also only performed on iOS 11.0.2, 10.3.3, and 10.3.2 because the available devices for testing older versions of iOS didn't have cellular service. Over recordings were also only performed on iOS 11.0.2, 10.3.3, and 10.3.2 because these were the only available versions of iOS that provided the option to record over original audio files. When original recordings we re recorded over again, the bit rate always changed from 64 kbps to 256 kbps and the sampling rate stayed the same at 44.1 kHz. It didn't matter if the over recording took place at the beginning of the file, the middle of t he file, or the end of the file, the changes to the bit rate were always the same. Another type of editing scenario that was briefly looked into was making edits to recordings on a newer version of iOS then the version that was used to make the recording. The purpose of this scenario is to see if the embedded iOS version changes after the files are edited on a different version of iOS. In the few recordings that were edited this way, the files embedded iOS version changed to the newer version of iOS that was used to edit the file. This was only done on a limited number of recordings and needs to be researched further. There was one odd inconsistency with the test recordings from iOS 10.3.3, 10.3.2 and 11.0.2 Two of the sets of test recordings from 10. 3.3 all had a sampling rate of 44.1 kHz no matter if they were continuous recordings, had pauses, or were edited in someway. The third set of recordings had some recordings that came out with a sampling rate of 48 kHz though. All three sets of test recor dings from 10.3.2 had recordings with a

PAGE 36

28 sampling rate of 48 kHz and some with 44.1 kHz. There's no pattern to what recordings had what sampling rate between all three sets of data. Almost all the recordings across all three sets of data for iOS 11.0.2 wer e 48 kHz as well. When recordings that started at 48 kHz were edited and re encoded, the sampling rates also changed to 44.1 kHz across all the version of iOS that had original recordings at 48 kHz. Other limited test recordings made o n iOS 11.0.1, 11.0.3, and 11.1 also show recordings being made at 48 kHz and 44.1 kHz. It's clear that iOS 10 11 is capable of making recordings at a sampling rate of 44.1 kHz as well as 48 kHz. When Voice Memos is deciding to use what sampling rate though is unknown and no pattern has been observed that causes Voice Memos to record at 48 kHz.

PAGE 37

29 CHAPTER VI CONCLUSION Voice Memos h as changed a few times since it' s initial release but as we've seen after examining recordings from the app, even when it doesn't seem like Voice Memos has changed with a new version of iOS, that doesn't mean that Voice Memos isn't operating differently. Knowing these traits and patterns of how recordings change after certain functions are performed could potentially help investigator s when analyzing audio recordings from Voice Memos. The characteristics could also help investigators identify what phones audio recordings came from as well if recordings have been edited in Voice Memos an d how they were edited Future Research New updates of iOS are usually released a couple times throughout the year. As new updates and new versions of iOS are released, the test recording collection protocol should be used to gat her data from the new upd ates. Sooner or later Apple is bound to also update Voice Memos in some major way. If new features are added or new ways/scenarios of making recordings are possible, the test recording collection protocol will hav e to be updated to include the new change s. This way good reliable data can continue to be collected from Voice Memos for the foreseeable future. More testing also needs to be done to see how recordings that were made with older versions of iOS change after being edited on a newer version of i OS. This process could potentially be built into the test recording collection protocol for the future. The

PAGE 38

30 differences in the record/encode dates of original unaltered recordings could also be measured to see if they're consistent patterns for specific versions of iOS. If each version of iOS has a pattern to the difference between the record/encode dates this could be used to identify recordings that came from an unknown version of iOS. Data still needs to be collected from iOS 5, 8 and 9. The test recording collection protocol should be used to gather data from these versions of iOS so we know how those recordings compare with the recordings we have from other versions of iOS. Once all this data is complete, decision trees should be crea ted for these versions of iOS. A decision tree for every version of iOS would be a great tool to aid in the authentication process and analysis of recordings made with Voice Memos. The problem of random recordings with a sampling rate of 48 kHz in iOS 10 11 also needs to be solved. If some sort of unique scenario or interaction with Voice Memos or the iPhone itself is causing the sampling rate to change to 48 kHz, this could be very useful inform ation for future analysis of Voice Memos recordings. This c ould also be valuable information for future iOS Voice Memo decision trees.

PAGE 39

31 REFERENCES 1. A pple iPhone sales by year 2007 2016. (n.d.). Retrieved October 17, 2017, from https://www.statista.com/statistics/276306/global apple iphone sales since fiscal year 2007/ 2. Diaz, J. (2009, March 17). IPhone 3.0 OS Guide: Everything You Need to Know. Retrieved November 01, 2017, from https://gizmodo.com/5171796/iphone 30 os guide everything you need to know 3. SWGDE Digital and Multimedia Evidence Glossary 2016 06 23, version 3.0. 4. Smith, J., Lacey, D., Koenig, B., & Grigoras, C. (2017). Triage Approach for the Forensic Analysis of Apple iOS Audio Files Recorded Using the "Voice Memos" App (pp. 1 10, Working paper). Arlington, VA: AES. 5. Ritchie, R. (2009, June 17). IPhone OS 3.0 review. Retrieved Octobe r 30, 2017, from https://www.imore.com/iphone os 30 review 6. Caldwell, C. B. (2013, September 19). Get to know iOS 7: Voice Memos. Retrieved October 30, 2017, from https://www.macworld.com/article/2048983/get to know ios 7 voice memos.html 7. Hargrave, Frank (01/01/2001). "Nyquist theorem" in Hargrave's Communications Dictionary: Basic Terms, Equations, Charts and Illustrations (0 7803 6020 6, 978 0 7803 6020 4), (p. 363).

PAGE 40

32 8. Elert, G. (n.d.). Frequency Range of Human Hearing. Retrieved October 30, 2017, from http://hypertextbook.com/facts/2003/Ch risDAmbrose.shtml 9. QuickTime File Format Specification. (2016, September 13). Retrieved November 01, 2017, from https://developer.apple.com/library/content/documentation/QuickTime/QTFF/ QTFFChap2/qtff2.html 10. IOS 11. (2017, November 01). Retrieved November 02, 2017, from https://www.macrumors.com/roundup/ios 11/ 11. MediaInfo. (n.d.). Retrieved November 09, 2017, from https://mediaarea.net/en/MediaInfo 12. Hex Fiend. (n.d.). Retrieved November 09, 2017, from http://ridi culousfish.com/hexfiend/ 13. Furlong, W. (n.d.). Overview. Retrieved November 09, 2017, from https://bitbucket.org/wez/atomicparsley/overview

PAGE 41

33 APPENDIX A TEST RECORDING COLLECTION P ROTOCOL iOS 10 11 IPHONE/IPOD TOUCH "VOICE MEMOS" TEST RECORDING PROTOCOL DOCUMENT THE FOLLOWING INFORMATION BEFORE PRODUCING TEST RECORDINGS: !"#$%&'!"$( ) *$+,# ) -$(&. ) %+-/&0 ) 12!3 ) 2!4+3. ) !%45&,6!$% ) $7 ) -$(&. ) %+-/&0 ) $% ) /3,8 ) ,$2&09 ) 1&:;:< ) "#$%&&'()**+,-..* ,/0/,/12/*3456*56/*0-77-34189 o !"#$%&= ) #6654=''4+55$06:355.&:,$-'&% > +4'?*@AB@CD ) #665=''EEE:355.&:,$-'!5#$%&'F*G' ) 134)%&&(&(9)7$0)F*G)H),$+%60I ) ,$%7!0-36!$% ) #665=''EEE:&2&0I!:,$-'/I > !(&%6!7!&0'!5$( > !5#$%& > !53( > 45&,4 > /I > -$(&. > %+-/&0 > 73-!.I > ) %+-/&0:#6-. ) o !"$( ) *$+,#= ) #6654=''4+55$06:355.&:,$-'&% > +4'?*@AJ@BK ) #665=''EEE:&2&0I!:,$-'/I > !(&%6!7!&0'!5$( > !5#$%& > !53( > 45&,4 > /I > -$(&. > %+-/&0 > 73-!.I > ) %+-/&0:#6-. ) !"#$%&'!"$()*$+,#)LM$(&.N)12!3)O&66!%;4'P&%&03.'Q/$+6'M$(&.9)1&:;:<)LMPQR@FF'QNS)0&7&04)6$)-$(&.<),300!&0<),353,!6I<) H),$.$09)T*QUG)OVWGGX)OXQ"Y:))V0$44)0&7&0&%,&)E!6#)6#& ) 7$..$E!%;= ) o Q55.&) Z&2!,&4)/I)[0(&0)X+-/&0= ) #665=''EEE:&2&0I!:,$-'/I > !(&%6!7!&0'!5$( > !5#$%& > !53( > ) 45&,4 > /I > 355.& > $0(&0 > %+-/&0 > 5306 > %+-/&0:#6-. ) o !"#$%&)DO)M$(&.)X+-/&04= ) #665=''.&!-$/!.&:,$-'!5#$%& > D4 > -$(&. > %+-/&04' ) !"#$%&'!"$( ) *$+,# ) 4&0!3. ) %+-/&0 ) 12!3 ) O&66!%;4'P&%&03.'Q/$+6'O&0!3. ) X+-/&09 ) T*QUG ) OVWGGX ) OXQ"Y )

PAGE 42

34 ![O)2&04!$%)12!3)O&66!%;4'P&%&03.'Q/$+6'\&04!$%9)T&:;:<)LC:@:B)1B]ZB^9NY)T*QUG)OVWGGX ) OXQ"Y ) L\$!,&)M&-$4N)(&73+.6)0&,$0(!%;)%3-&)7$0)%&_6)0&,$0(!%;<)!7)8%$E%:)LX&E)W&,$0(!%;)`N) !4)6#&)(&73+.6)%3-!%;) ,$%2&%6!$%<)E!6#)L`N)/&!%;)3)%+-&0!,3.)23.+&)6#36)!%,0&-&%64)E!6#)&3,#)%&E)0&,$0(!%;:)X$6&)6#36)L`N)E!..)/&)%&_6) %+-&0!,3.)23.+&)7$0)E#!,#)%$)0&,$0(!%;)&_!464)3%()-3I)/&)$+6)$7),#0$%$.$;!,3.)$0(&0:))a$0)&_3-5.&<)!7)LX&E)W&,$0(!%;)BN<) LX&E)W&,$0(!%;)]N<)3%()LX&E)W&,$0(!%;)JN)&_!46<)6#& ) %&_6 ) ,/2-,:418*3477*;/*"1:*56/1*"05/,*56>5)

PAGE 43

35

PAGE 44

36

PAGE 45

37

PAGE 46

38

PAGE 47

39

PAGE 48

40

PAGE 49

41

PAGE 50

42

PAGE 51

43

PAGE 52

44

PAGE 53

45

PAGE 54

46 APPENDIX B TEST RECORDING COLLECTION PROTOCOL iOS 7 IPHONE/IPOD TOUCH "VOICE MEMOS" TEST RECORDING PROTOCOL DOCUMENT THE FOLLOWING INFORMATION BEFORE PRODUCING TEST RECORDINGS: !"#$%&'!"$( ) *$+,# ) -$(&. ) %+-/&0 ) 12!3 ) 2!4+3. ) !%45&,6!$% ) $7 ) -$(&. ) %+-/&0 ) $% ) /3,8 ) ,$2&09 ) 1&:;:< ) "#$%&&'()**+,-..*,/0/,/12/*3456*56/*0-77-34189 o !"#$%&= ) #6654=''4+55$06:355.&:,$-'&% > +4'?*@AB@CD ) #665=''EEE:355.&:,$-'!5#$%&'F*G' ) 134)%&&(&(9)7$0 ) F*G)H),$+%60I ) ,$%7!0-36!$% ) #665=''EEE:&2&0I!:,$-'/I > !(&%6!7!&0'!5$( > !5#$%& > !53( > 45&,4 > /I > -$(&. > %+-/&0 > 73-!.I > ) %+-/&0:#6-. ) o !"$( ) *$+,#= ) #6654=''4+55$06:355.&:,$-'&% > +4'?*@AJ@BK ) #665=''EEE:&2&0I!:,$-'/I > !(&%6!7!&0'!5$( > !5#$%& > !53( > 45&,4 > /I > -$(&. > %+-/&0 > 73-!.I > ) %+-/&0:#6-. ) !"#$%&'!"$()*$+,#)LM$(&.N)12!3)O&66!%;4'P&%&03.'Q/$+6'M$(&.9)1&:;:<)LMPQR@FF'QNS)0&7&04)6$)-$(&.<),300!&0<),353,!6I<) H),$.$09)T*QUG)OVWGGX)OXQ"Y:))V0$44)0&7&0&%,&)E!6#)6#& ) 7$..$E!%;= ) o Q55.&)Z&2!,&4)/I)[0(&0)X+-/&0= ) #665=''EEE:&2&0I!:,$-'/I > !(&%6!7!&0'!5$( > !5#$%& > !53( > ) 45&,4 > /I > 355.& > $0(&0 > %+-/&0 > 5306 > %+-/&0:#6-. ) o !"#$%&)DO)M$(&.)X+-/&04= ) #665=''.&!-$/!.&:,$-'!5#$%& > D4 > -$(&. > %+-/&04' ) !"#$%&'!"$( ) *$+,# ) 4&0!3. ) %+-/&0 ) 12!3 ) O&66!%;4 'P&%&03.'Q/$+6'O&0!3. ) X+-/&09 ) T*QUG ) OVWGGX ) OXQ"Y ) ![O)2&04!$%)12!3)O&66!%;4'P&%&03.'Q/$+6'\&04!$%9)T&:;:<)LC:@:B)1B]ZB^9NY)T*QUG)OVWGGX ) OXQ"Y )

PAGE 55

47 L\$!,&)M&-$4N)(&73+.6)0&,$0(!%;)%3-&)7$0)%&_6)0&,$0(!%;<)!7)8%$E%:)LX&E)W&,$0(!%;)`N)!4)6#&)(&73+.6)%3-!%;) ,$%2&%6!$%<)E!6#)L`N)/&!%;)3)%+-&0!,3.)23.+&)6#36)!%,0&-&%64)E!6#)&3,#)%&E)0&,$0(!%;:)X$6&)6#36)L`N)E!..)/&)%&_6) %+-&0!,3.)23.+&)7$0)E#!,#)%$)0&,$0(!%;)&_!464)3%()-3I)/&)$+6)$7),#0$%$.$;!,3.)$0(&0:))a$0)&_3-5.&<)!7)LX&E)W&,$0(!%;)BN<) LX&E)W&,$0(!%;)]N<)3%( ) LX&E)W&,$0(!%;)JN)&_!46<)6#& ) %&_6 ) ,/2-,:418*3477*;/*"1:*56/1*"05/,*56>5)

PAGE 56

48

PAGE 57

49

PAGE 58

50

PAGE 59

51

PAGE 60

52

PAGE 61

53

PAGE 62

54 APPENDIX C TEST RECORDING COLLECTION PROTOCOL iOS 6 IPHONE/IPOD TOUCH "VOICE MEMOS" TEST RECORDING PROTOCOL DOCUMENT THE FOLLOWING INFORMATION BEFORE PRODUCING TEST RECORDINGS: !"#$%&'!"$( ) *$+,# ) -$(&. ) %+-/&0 ) 12!3 ) 2!4+3. ) !%45&,6!$% ) $7 ) -$(&. ) %+-/&0 ) $% ) /3,8 ) ,$2&09 ) 1&:;:< ) "#$%&&'()**+,-..*,/0/,/12/*3456*56/*0-77-34189 o !"#$%&= ) #6654=''4+55$06:355.&:,$-'&% > +4'?*@AB@CD ) #665=''EEE:355.&:,$-'!5#$%&'F*G' ) 134)%&&(&(9)7$0)F*G)H),$+%60I ) ,$%7!0-36!$% ) #665=''EEE:&2&0I!:,$-'/I > !(&%6!7!&0'!5$( > !5#$%& > !53( > 45&,4 > /I > -$(&. > %+-/&0 > 73-!.I > ) %+-/&0:#6-. ) o !"$( ) *$+,#= ) #6654=''4+55$06:355.&:,$-'&% > +4'?*@AJ@BK ) #665=''EEE:&2&0I!:,$-'/I > !(&%6!7!&0'!5$( > !5#$%& > !53( > 45&,4 > /I > -$(&. > %+-/&0 > 73-!.I > ) %+-/&0:#6-. ) !"#$%&'!"$()*$+,#)LM$(&.N)12!3)O&66!%;4'P&%&03.'Q/$+6'M$(&.9)1&:;:<)LMPQR@FF'QNS)0&7&04)6$)-$(&.<),300!&0<),353,!6I<) H),$.$09)T*QUG)OVWGGX)OXQ"Y:))V0$44)0&7&0&%,&)E!6#)6#& ) 7$..$E!%;= ) o Q55.&) Z&2!,&4)/I)[0(&0)X+-/&0= ) #665=''EEE:&2&0I!:,$-'/I > !(&%6!7!&0'!5$( > !5#$%& > !53( > ) 45&,4 > /I > 355.& > $0(&0 > %+-/&0 > 5306 > %+-/&0:#6-. ) o !"#$%&)DO)M$(&.)X+-/&04= ) #665=''.&!-$/!.&:,$-'!5#$%& > D4 > -$(&. > %+-/&04' ) !"#$%&'!"$( ) *$+,# ) 4&0!3. ) %+-/&0 ) 12!3 ) O&66!%;4'P&%&03.'Q/$+6'O&0!3. ) X+-/&09 ) T*QUG ) OVWGGX ) OXQ"Y )

PAGE 63

55 ![O)2&04!$%)12!3)O&66!%;4'P&%&03.'Q/$+6'\&04!$%9)T&:;:<)LC:@:B)1B]ZB^9NY)T*QUG)OVWGGX ) OXQ"Y ) L\$!,&)M&-$4N)(&73+.6)0&,$0(!%;)%3-&)7$0)%&_6)0&,$0(!%;<)!7)8%$E%:)LX&E)W&,$0(!%;)`N) !4)6#&)(&73+.6)%3-!%;) ,$%2&%6!$%<)E!6#)L`N)/&!%;)3)%+-&0!,3.)23.+&)6#36)!%,0&-&%64)E!6#)&3,#)%&E)0&,$0(!%;:)X$6&)6#36)L`N)E!..)/&)%&_6) %+-&0!,3.)23.+&)7$0)E#!,#)%$)0&,$0(!%;)&_!464)3%()-3I)/&)$+6)$7),#0$%$.$;!,3.)$0(&0:))a$0)&_3-5.&<)!7)LX&E)W&,$0(!%;)BN<) LX&E)W&,$0(!%;)]N<)3%()LX&E)W&,$0(!%;)JN)&_!46<)6#& ) %&_6 ) ,/2-,:418*3477*;/*"1:*56/1*"05/,*56>5)

PAGE 64

56

PAGE 65

57

PAGE 66

58

PAGE 67

59

PAGE 68

60

PAGE 69

61

PAGE 70

62 APPENDIX D DECISION TREE

PAGE 71

63 APPENDIX E DECISION TREE iOS 4 6

PAGE 72

64 APPENDIX F DECISION TREE iOS 7

PAGE 73

65 APPENDIX G DECISION TREE iOS 10

PAGE 74

66

PAGE 75

67 APPENDIX H DECISION TREE iOS 11

PAGE 76

68