Deepfakes as evidence — a new face of manipulation and the response of modern forensic science

Hearing a familiar voice, recognising a face and watching a recording of an event may no longer be enough to establish what actually happened. Advances in artificial intelligence have made it possible to create material that attributes words, gestures and actions to real people who never said or did those things. In response, forensic methods are being developed to examine the provenance, integrity and authenticity of digital material.

From false information to a fabricated picture of reality

Falsifying information is nothing new. What has changed is the technology: reproducing someone’s voice, replacing a face or generating a convincing statement can create an apparent record of reality. Manipulation can affect not only how an event is presented, but whether the event depicted in the digital material happened at all.

Deepfake is a term for material created or modified using artificial intelligence that can convincingly imitate a person’s appearance or voice. A recording may be entirely synthetic, or the alteration may affect only part of genuine footage — for example, the words spoken or one person’s face. This forms part of the broader issue of the authenticity and provenance of digital content. ^[1]

The implications extend beyond online disinformation. Imagine a business owner receiving a voice message in which their partner instructs them to make an urgent transfer. Or someone whose purportedly recorded remarks are circulated to damage their reputation. In either situation, a recognisable voice or face may persuade recipients that the material is genuine before anyone checks where it came from.

When a fabricated recording becomes evidence

A particular risk arises when manipulated material is used to support a particular account of events in a dispute.

A hypothetical recording might depict an acknowledgement of debt, consent to a contract, threats or a conversation about handing over money. If the statement was generated, the material creates the appearance of an event that never occurred.

Several questions therefore need to be considered separately: do we recognise the person in the recording, does the file come from its claimed source, has its content been altered, and does the excerpt retain its proper context? Examining a file’s source and examining alterations to its content may require different methods. ^[2]

There is also a risk in the opposite direction: deepfake technology can be invoked as a convenient explanation for genuine but inconvenient footage. Assessing evidence therefore requires caution in both directions. A convincing-sounding statement does not establish its authenticity, just as an allegation of AI use does not prove fabrication.

Not every manipulation requires artificial intelligence

The reliability of recordings is a broader issue than deepfakes. The meaning of a statement can be changed by removing a question, cutting out a qualification, joining distant sections of a conversation or adding a misleading description.

For example, the answer “yes” may concern a completely different matter from the one suggested by an edited clip. Even a genuine voice does not guarantee that the version presented faithfully reflects the conversation.

This distinction matters when planning an examination: the question of AI use should not obscure the possibility of ordinary editing or the omission of important context.

How do modern forensic methods examine recordings?

Analysis goes beyond watching a video or listening to a conversation. It may examine both the content and the technical structure of the material:

• Examining file provenance — assessing whether its characteristics match the claimed method of recording.
• Analysing metadata and encoding — looking for information about devices, software and processing.
• Examining images and sound — looking for signs of alteration and inconsistencies.
• Comparing reference material — for example, footage from the device said to have made the recording.
• Using AI detectors — assessing features that may indicate synthetic content.

The choice of methods depends on the file type, its quality and the question the examination is intended to answer. SWGDE guidelines recommend combining different methods where possible, because each has limitations. ^{[2] [3]}

Why are blinking and lip movements not enough?

Unnatural facial expressions, inconsistent lighting or a mismatch between speech and lip movements may attract attention. They do not, however, constitute a universal test of authenticity.

Generation methods change, and a detector that works well for one technique may be less effective for another. Compression, resolution changes and further processing create additional difficulties. NIST identifies robustness to such changes and the ability to detect material from new generators as important research challenges. ^[4]

A suspicious detail therefore needs explanation. It may result from manipulation, but it may also reflect how an image was recorded or processed.

An AI detector does not deliver a verdict

An automated result requires interpretation. A message saying “90% deepfake” does not necessarily mean a 90 per cent probability that the particular item of evidence is fabricated. Its meaning depends on the tool’s design, calibration and conditions of use.

Both false alarms and failures to detect synthetic material are possible. Evaluation should consider a tool’s effectiveness on material representative of real-world use. NIST examines these issues in its work on synthetic content detection and the evaluation of detection technologies. ^{[1] [4]}

Finding no signs of manipulation is not the same as confirming authenticity. Sometimes the available material supports only a cautious conclusion, or leaves the question unresolved.

Why preserve the source file?

Further copies, exports and transmission through messaging services can change a recording’s technical characteristics. A sound examination therefore benefits from preserving the source file, information about its acquisition and, where available, the recording device.

Documenting subsequent handling is also important. This helps distinguish changes made before preservation from later technical operations. Video analysis guidelines address appropriate evidence handling and documentation of examinations. ^[5]

What should be checked in an expert report on a recording?

The following questions have practical significance:

1. Which exact file was examined, and where was it obtained?
2. Was the source material available?
3. Which tools and methods were used?
4. Were they suitable for the type and quality of the recording?
5. What limitations could have affected the result?
6. Can the examination and its conclusions be reproduced and checked?

SWGDE emphasises systematic examination, repeatability and the use of validated tools and methods. These requirements help assess the basis of an opinion rather than relying solely on the expert’s final assertion. ^[2]

Deepfake technology means that “What can we see and hear?” must be accompanied by “How was this material created?” Modern forensic science is developing tools to investigate that question, and their value depends on rigorous use and transparent explanation of their limitations. A recording’s evidential strength should rest on the ability to verify its reliability.

Sources