## 1 Introduction  
The current solutions for editing multimedia files allow almost anyone to modify them with results that would not draw the attention of a listener. Free software suites exist, such as Audacity. In this context, proving the authenticity of recordings has a great importance if they are to be used in a court of law. Based on their purpose, audio forensics methods can be classified as follows:  
* Methods for authenticity checking--have the goal to find the date and time of a recording, the device that was used for recording, etc. * Methods for integrity checking--aim to detect if the analyzed recording was modified in ways that would change the meaning of the message [1; 2]. The solutions for checking the integrity of an audio recording are classified in two categories:  
* Passive methods--investigate the artifacts caused by the editing operations such as double compression [3], reverberation changes or, in the case of copy-move operations, consequences of the editing (e.g., finding that certain words are uttered identically in the recording, which is improbable in reality), etc. The great advantage of these methods is that they can be used to analyse any recording. However, the degree of certainty of the result is not high enough to consider them reliable. For example, double compression happens when audio recordings are edited, but it cannot highlight if the meaning of the message has been modified;
* Active methods--rely on the insertion of auxiliary data during the recording. Those are extracted in the integrity check process and compared with the reference data that were inserted when the recording was captured. If the extracted data matches the reference, it can be concluded that the integrity of the recording was preserved. These methods offer a much greater degree of certainty about the offered result, but only the recordings that contain the auxiliary data can be checked. One great breakthrough in both audio authentication and integrity checking was represented by the ENF criterion [4]. This method is based on one key property of the electrical power distribution network: the frequency of the electrical network signal varies randomly in time and is the same over a large area. The variations around the nominal frequency are very small, but detectable. When audio recordings are made in buildings connected to the power grid, the recording devices pick up the electrical network signal. The picked-up signal is very small since the devices are designed to prevent its capture because it contaminates the recording. To check the integrity of a recording, the picked-up electrical network signal is extracted from it, then its frequency variation in time is estimated. Finally, the extracted variation of the ENF is compared with a reference variation that is obtained by monitoring the electrical network signal directly using monitoring stations [5]. Because the variation of the ENF is the same over large areas, only a small number of stations that monitor the electrical network and can deliver the reference ENF variation are needed to cover large territories. The reference ENF variation can be obtained also from the power distribution and monitoring companies. To illustrate the properties presented above, the variation of the ENF for one hour is shown in Figure 1. It was measured by [6] on the 1 st of January 2015, between 12:00 a.m. (00:00) and 01:00 a.m. (01:00), with one second resolution. Figure 1: Example of ENF behavior (recorded by [6] on the 1 st of January 2015 between midnight and 01:00 a.m.). The ENF criterion can be classified both as an authentication and integrity check method. Because the ENF varies randomly in time, the variation acts like a timestamp. Having available the reference variation of the ENF over a long period of time, the moment when a recording was made can be determined by extracting the ENF variation from it and computing the correlation with the reference ENF variation [7]. The peak value will be found at the most likely recording moment.