Look for cuts and joins in a recording SPLICE

What a cut leaves behind

An edit is a join, and a join is a place where two things that were never adjacent have been put next to each other. Four measurable traces tend to survive that, and SPLICE looks for all four.

• A step in the waveform. Audio is a line, and a cut made anywhere other than a zero crossing leaves a vertical jump in it. Every sample-to-sample difference in the file is compared with the median difference in the fifty milliseconds either side of it, and a jump at least ten times that local median is flagged. Hits within twenty milliseconds of each other are collapsed into one, so a single join is reported once rather than as a cluster.
• A change in the background. Every room has a tone: ventilation, traffic, the noise floor of the microphone itself. The file is cut into quarter-second windows and the quiet floor of eight windows before a point is compared with the eight after it. A step of six decibels or more is a change of room, of microphone, or of session.
• A jump in DC offset. Different hardware sits at a slightly different electrical zero. Two recordings made on two devices, or on one device at two different times, rarely share theirs, and the offset does not change on its own part-way through a take.
• Runs of exact digital silence. A microphone in a real room does not produce samples of precisely zero. Software does: muting, a removed passage, a gap left by a joining tool. A stretch of perfect zeros is a stretch that was written rather than recorded.

Finding nothing is not evidence of anything

This is the part that matters, and it is the reason the results are timestamps rather than a verdict.

Every one of those four traces is destroyed by a lossy re-encode. Anything that has been through MP3, AAC, or a messaging app has been rebuilt from a frequency representation that does not preserve sample-to-sample steps at all, and the encoder smooths precisely the discontinuities this is looking for. A crossfade of five milliseconds (the default in every editor on the market) hides a join completely, and costs the person making it nothing. A clean recording that was cut carefully and exported as MP3 can leave nothing here to find.

So a report with no findings means the file does not carry these particular traces. It does not mean the recording is unedited, and it should never be presented as though it does.

Finding something is not proof either

The same measurements come out of things nobody edited. A door closing, a microphone knocked, a peak that clipped, a buffer dropped by the recording software, an automatic gain control deciding to change the level mid-sentence: all of them produce a step, a level change, or both. Digital silence appears wherever a device muted itself.

What the tool is actually for is narrowing where to listen. An hour of audio is an hour of listening; a list of a dozen timestamps is a few minutes. Play each one, decide what you are hearing, and let your conclusion come from the audio rather than from the chart.

Work from the original file if you can get it. WAV, or whatever the device wrote before anything re-encoded it, carries everything; a copy that arrived over a chat app has already been through the process that erases the evidence. X-RAY shows what else is inside the container, CHAIN records how the copy you are examining reached you, and TAMPER does the equivalent job for a photograph.