Anti-Forensics and Countermeasures of Electrical Network Frequency Analysis

The electrical network frequency (ENF) signal is a time stamp that has been used by an emerging class of approaches for determining the creation time of digital audio and video recordings. However, in adversarial environments, anti-forensic operations may be conducted to manipulate ENF-based time stamps, and it is crucial to understand the resilience of ENF analysis against anti-forensics. This paper explores possible anti-forensic operations that can remove and alter the ENF signal while trying to preserve the host signal, and devises detection methods targeting these operations. Concealment techniques that can circumvent detection are also discussed and their corresponding trade-offs are examined. Based on the understanding of individual anti-forensic operations and countermeasures, this paper further characterizes the dynamic interplay between forensic analysts and adversaries by providing an evolutionary perspective and a game-theoretical perspective as well as studying representative scenarios and the optimal forensic/anti-forensic strategies.