ENF analysis: uses and limits

Electrical grids operate around a nominal frequency, commonly 50 or 60 hertz. Hertz means cycles per second. The frequency varies slightly as the balance of generation and demand changes. A recorder can sometimes capture a trace of those variations through electrical interference or sound associated with mains-powered equipment.

The useful evidence is the pattern of change over time. A single peak near 50 or 60 Hz is not a recording date. In his early technical application note, Catalin Grigoras described comparing a recording's changing frequency pattern with a reference recorded from the electrical network. He also stressed reference quality and combining ENF with other examination methods.

Think of the comparison as two separate inputs: a trace extracted from the questioned recording and reference data whose timing and origin are known. Processing the questioned file cannot supply missing historical reference data.

An examiner first needs to determine whether a usable ENF component exists. A battery-powered device does not automatically rule it out: University of Tennessee researchers describe hum captured in battery-powered recordings. Conversely, recording near electrical equipment does not guarantee a clear, usable trace.

The component may be weak, masked or intermittent. Its harmonics may be more useful than its nominal fundamental frequency. A recording's previous processing and copying history also matters. Keep the earliest available file and document exports or conversions; retain an original alongside any listening copy.

Duration matters, but there is no universal number of seconds that makes every recording suitable. Garg, Varna and Wu's timestamp-verification research examined how duration, noise and the matching method affect performance. Their work also addressed self-similarity in ENF patterns. The question is whether this particular trace contains enough reliable information for the proposed comparison.

Before analysis, supply the claimed date or date range, likely recording region, recording device and any known editing or transfer history. Unknown information should remain unknown. A convenient guess can restrict a search in a way that conceals an alternative explanation.

A timestamp comparison needs reference data relevant to the recording's grid and possible time period. Ask what reference is available, which dates it covers, whether it contains gaps and how its timekeeping and integrity are established.

SWGDE's 2014 discussion paper separates collection, extraction, comparison and interpretation. It also raises the possibility that a questioned trace comes from a grid or time outside the database. That matters when interpreting an unsuccessful match: the relevant reference may be absent, even if the questioned recording contains an ENF component.

Do not assume a database mentioned in an old paper is currently public, complete or available to the examiner. Reference access and coverage need to be checked for the actual assignment.

A comparison should explain what was examined, what alternatives were considered and how the result was evaluated. A high similarity value is not, by itself, the probability that a file is authentic.

Different result states answer different questions:

• No usable trace: this method may not provide a useful answer from the available file.
• No suitable reference: a date comparison cannot be completed with that reference.
• No supported match: the search did not establish a match under the tested conditions.
• A supported match: the examiner should state which timing proposition it supports, its uncertainty and any remaining qualifications.

These states should not collapse into a simple “real” or “fake” label. In particular, an absent or disappearing trace does not automatically establish an edit. In the Tom Scott demonstration, a forensic examiner explained that a trace could stop because of an edit or because the recorder moved away from the source of ENF energy.

SWGDE also notes that a duplicated recording can contain components associated with the original and the duplication system. The recording history therefore belongs in the interpretation, not just in the file-transfer paperwork.

Published research can show that a method works better under specified conditions without establishing a success rate for every future recording.

For example, Karantaidis and Kotropoulos compared ENF estimates with a ground-truth signal in six video recordings. Their reported maximum correlation coefficients varied by recording and method. Those coefficients describe that experiment's signal agreement; they are not percentages of authentic recordings or probabilities that a disputed file is genuine.

The authors used fixed cameras and expressly identified moving cameras and scenes containing more people as further challenges. A useful report distinguishes a published method's tested conditions from the conditions in the file under examination.

A video's audio track can contain a hum trace. ENF can also be investigated through variations in recorded lighting. These are different signal paths. Camera sampling, lighting and sensor behavior affect the optical route; a video is not suitable merely because it was recorded indoors.

Location estimation is also a separate proposition from date matching. In a 2025 study, Ngharamike, Ang and Seng investigated smartphone videos within the Australian Eastern grid using reference data from anchor locations. They described regional narrowing and limitations related to grid topology, anchor coverage and inconsistent correlations. They explicitly cautioned against treating the method as universally precise pinpoint location identification.

Ask which location claim is actually supported: a possible grid, a region under a tested method, or a more specific conclusion with its own evidence. Do not turn a regional research result into a street-address promise.

Before commissioning or relying on ENF work, ask:

1. What precise question will this examination address: timing, continuity, possible editing or location?
2. Is there a usable trace in the earliest available file, and which part will be examined?
3. Which reference data will be used, and does it cover the relevant grid and dates?
4. How will noise, duration, copying and processing history affect the comparison?
5. What alternative explanations and unsuccessful result states will the report distinguish?
6. Which other evidence will be used to corroborate or qualify the finding?

For the wider distinction between listening improvement and authenticity examination, read our audio authentication guide. Keep source files and processing history using the evidence preservation guide.

This guide compares technical descriptions, original research and their stated limits. It separates the prerequisites for extracting a trace, matching it to reference data and interpreting a result. The six-video comparison uses values reported in one published experiment; we did not collect ENF data or test a recording.

The cited studies concern different methods and settings. Their results do not establish a universal duration threshold, a current reference database's availability, an examiner's capability or a conclusion about your file. An individual examination needs evidence and a stated question of its own.

ENF can provide an additional line of examination when a suitable trace, relevant reference data and an appropriate validated method come together. Its value comes from a defined comparison and careful interpretation. Preserve the source and ask what the result can support before treating it as a date, location or authenticity verdict.