Recording guide
Preserve audio & video evidence
Keep the original, its context and a clear record of every copy.
The short answer
Keep the recording, its copies and its history distinct
- Keep the source unchanged and use separate working copies.
- Retain full context, available metadata and the known handling history.
- Back up the source and notes in a separate approved location.
- Agree on the review task and file handling before sharing sensitive recordings.
Preserve the recording before review
To preserve audio and video evidence, keep the available source unchanged, document where it came from and retain separate backup and working copies. Save the complete recording and its context before clipping, converting or enhancing it.
For an attorney or legal team preparing a difficult recording, the first job is to keep what is available and make its history understandable. This guide explains the practical file decisions, then shows what to prepare for a free file review.

Which recording should you keep?
Keep the earliest available recording unchanged, together with what you know about where it came from. Make a separate working copy before trimming, converting or enhancing it.
The original recording may still be on a phone, recorder, camera system or account. A file forwarded to your legal team may already have been exported or processed. Record that distinction rather than calling every received file an untouched original.
- Retain the full file as received, including its existing name and any accompanying messages or export notes.
- Identify who supplied it, the device or system it came from, and any earlier version that may still exist.
- Keep a separate copy for listening, viewing and processing. Save new outputs under distinct names.
If you only have a copy, keep it. It may still contain useful information. Ask the person who supplied it whether an earlier file or native export is available, and tell the reviewer what remains unknown.
When another person controls the recording, identify the system and the relevant date, camera and time interval promptly. CCTV and dashcam systems may overwrite footage. For casework, ask the responsible attorney or collector to arrange preservation and collection before routine deletion; file restoration cannot bring back material that was never supplied.
How should you save each source?
Save the underlying file or native export when it is available, and retain the context needed to identify and open it. A screen recording or an audio recording of a loudspeaker is a different version from the digital source.
| Source | What to retain | What to explain |
|---|---|---|
| Phone recording or voicemail | The saved recording, available message details and relevant call history | Which app or service supplied it, when it was saved, and whether it was forwarded or re-recorded |
| CCTV, dashcam or security system | The available native export, related files, and any supplied player or opening instructions | Camera or channel, requested interval, export method and any known clock offset |
| Online or shared video | The available file or capture, its source URL and the accompanying message or page context | Where it appeared, when you obtained it, and whether the underlying upload is available |
| Audio taken from video | The complete video as well as the separately named audio derivative | How the audio was extracted and which video interval it represents |
If a voicemail or online video cannot be exported, a reference capture may be the only material available. Keep it and describe how it was made. Do not discard it because it is imperfect, or treat it as equivalent to a native source.
Check that an export covers the intended interval and contains the expected audio or camera channel. Keep the surrounding context. Avoid repeated conversion merely to make a file easier to send; ask which format is needed first.
What belongs in the file history?
Record who supplied or handled each version, when it moved, where it was kept and what was done to it. Keep these notes with the file set so another person can follow the sequence.
Useful entries include the original file name, source device or account, person making the export, receipt or transfer date, purpose of the action, output name and relevant timestamps. Separate what you observed from what someone else told you.
For example, a simple handling log for a hypothetical interview recording might read:
| Action | File or version | Note to retain |
|---|---|---|
| Received | interview.m4a | Who supplied it, date received, reported source and any unknown earlier handling |
| Copied for review | interview-working.m4a | Who made the copy, when, where it was saved and why |
| Processed | interview-cleanup-v1.wav | Which working file was used, who processed it, what changed and when |
A practical file log supports later review; it does not itself certify a formal chain of custody. Follow the evidence-handling procedure for the matter. If the earlier history is unknown, write “unknown.” A note created today should not imply that you witnessed an earlier transfer.
Which dates can you rely on?
Keep the event time, the time you received the file and the file’s displayed timestamps separate. They describe different things and may not agree.
A camera clock may be wrong. Exporting or copying can produce a new file date. Retain the available metadata and record any known time zone or clock discrepancy alongside the file, including how you learned about it. Do not change the source to make the dates match your account.
Metadata can help explain a recording’s history, but a displayed date is not independent proof of when the recorded event occurred.
Event, receipt and file dates describe different things
The date attributed to the recorded event, the date a file was received, and a file date created by copying or export are different labels.
- Event date: Recorded occurrence. Record the attributed event time and any known recording-clock discrepancy.
- Receipt date: File supplied to you. Note when you received this version and who supplied it.
- File date: Copy or export timestamp. Keep the displayed date as file context; record how this version was obtained.
Source: Tech Safety Canada
What does a file hash show?
A matching cryptographic hash supports that the compared file data are unchanged. It does not establish who made the recording or whether the recorded event happened as claimed.
A hash is a calculated value based on file data. If your organization’s procedure uses hashes, have the responsible person record the algorithm, value, file version and time of comparison. Keep the record available with the handling documentation.
The SWGDE collection guidance, version 1.2 (July 2017), distinguishes file integrity from authentication. It also explains that a file without a collection-time hash may be authenticated through other means. Keep the available recording and disclose the gap.
Where should backup copies live?
Keep a backup in a separate location from the files used for daily work, using storage permitted for the matter. A working copy on the same laptop will not help if that laptop is lost or fails.
- Retain the source and its accompanying notes in the agreed storage location.
- Keep another copy on separate storage or in another approved location.
- Check that the saved files can still be accessed and that the accompanying information is present.
- Keep track of who can access the copies and any applicable retention instructions.
The Library of Congress personal-audio guide recommends copies in different locations and periodic checks that files remain readable. For casework, apply your organization’s handling requirements when choosing those locations.
A storage account, removable drive or backup service is useful only if the people responsible know where the files are and can still access them.
A working copy is still in the same location
The source and daily working copy can share one location. A backup of the source and its notes belongs in a separate approved storage location.
- Source + notes: Retained together. Keep the complete recording and its accompanying history available together.
- Working copy: Daily review. A second file on the same laptop shares that laptop’s loss or failure.
- Backup + notes: Separate location. Use another approved storage location and check that the files remain accessible.
Source: Library of Congress
Can you edit a working copy?
Yes. You can prepare a separate working copy for listening, clipping or restoration while keeping the complete source unchanged. Name the result so its relationship to the source is clear.
A short clip can help someone locate an exchange, but retain the full recording and identify the clip’s start and end times. A timestamp list may be enough for an initial request, without creating another file.
Keep three roles distinguishable: the source as received, a working or reference copy, and any processed output. A name such as “interview-cleanup-v1” is more useful than overwriting the source or naming several different files “final.” Keep the original file name in your notes.
If someone has already used editing software or AI cleanup, keep that version too. Record the source used and the processing known to you. Earlier work can be useful context; it should not erase the route back to the recording you started with.
The source stays separate from each output
A retained source supplies a separate working copy. Reference clips and processed outputs come from the working copy, while the retained source remains distinct.
- Retained source: As received. Keep the complete source under its existing name, with its known history.
- Working copy: For review. Use a separate copy for listening, viewing or processing.
- Reference clip: Chosen interval. Record the start and end times and retain the full source.
- Processed output: Cleanup result. Use a distinct output name and keep notes of the processing known to you.
Source: Tech Safety Canada
Does clearer mean authenticated?
No. A clearer recording does not, by itself, establish authenticity, exact words or a speaker’s identity. Preservation and restoration address different parts of the work.
| Task | Question it addresses |
|---|---|
| Preservation | What material and history have been retained? |
| Enhancement | Can captured sound or picture information be easier to review? |
| Transcription | How can the speech be represented in writing, including uncertainty? |
| Authentication | What does a defined examination establish about the recording’s origin or history? |
Media Medic’s main service is restoration. Transcripts and authentication are paid additions, with their scope agreed separately. An enhancement request should not assume a report, testimony or a legal conclusion is included. See our guide to enhancement, transcription and authentication, or discuss a specific authenticity question before further processing.
For a recording that may be used in a matter, agree how the review will stay neutral:
- Describe the passage and the question without asking the reviewer to confirm a preferred account. Keep uncertain words or events marked as uncertain.
- Disclose earlier cleanup, clipping or AI processing. Ask which source and working copy will be used, how changes will be recorded and how the result will be compared with the source.
- Ask who will perform the defined examination, what relevant training and experience they have, and what limitations or further review may be needed.
These questions do not establish a credential or decide court use. Agree any court-use or authentication requirements separately with the responsible legal professional and reviewer.
What should you send for review?
Prepare the source or best available copy, the moments that matter, the problem you need assessed and your deadline. You do not need to diagnose the noise or know the technical name for the work.
- Describe the files. Give the recording type and file count, where they came from, and whether the original or an export is available.
- Identify the passage. Supply timestamps or explain how to locate the relevant moment. Say if you are not sure.
- Describe the difficulty. For example, a voice may be too quiet, overlap another speaker or be obscured by traffic. Describe what is hard to follow without supplying words you expect to hear.
- List earlier processing. Keep those versions separate and explain what was tried.
- State the deadline and handling needs. Confirm both before arranging file sharing.
Media Medic offers a free file review. An audio engineer listens to every file before an invoice is sent, so you can understand whether restoration may help and agree on the paid work. Normal turnaround is five days or less; a paid 24-hour upgrade is available. Confirm timing for your request.
Continue to audio enhancement or video cleanup, or request a free file review.
Other preservation questions
Keep the recording and its accompanying export files while you resolve playback, transcript or legal-use questions. A transcript or a more convenient copy can support review, but it should remain distinguishable from the retained source.
What if the file will not open?
Keep the file and any related export files or player instructions. Tell the reviewer which system produced it and what happens when you try to open it. Changing a filename extension does not convert the recording. Ask about the format before making conversions or discarding part of the export.
Use a copy for playback checks. Confirm the source system, export instructions and any supplied player, and note the exact error. A player may not support the file’s codec—the method used to encode and decode its sound or picture. A playback failure alone does not show that the recording is corrupt. Check with the source holder that the export finished and includes the requested interval, expected channels and accompanying files. Keep an incomplete export as received and label what is missing rather than overwriting it.
If a different format is needed, agree a documented conversion of a working copy. If data are missing or the storage medium is damaged, seek appropriately qualified recovery help before attempting repairs on the source. Sound restoration should not be assumed to fix an unreadable or incomplete file.
Is a transcript enough?
No. A transcript helps readers find or discuss speech, but it does not preserve the recorded sound, picture or all the file’s information. Keep the recording and transcript as separate materials. Mark unclear speech and uncertain speakers rather than turning an interpretation into a definite statement.
Does preservation make it admissible?
No. Preserving and documenting a recording helps prepare it for review; it does not decide admissibility. Consent, authenticity, completeness and presentation requirements depend on the matter and applicable rules. Ask the responsible legal professional what is needed, especially when the source or handling history is disputed.
Sources
- Tech Safety Canada: preserving audio recordings
- Tech Safety Canada: preserving video recordings
- Library of Congress: keeping personal digital audio
- SWGDE: Collection of Digital and Multimedia Evidence Myths vs Facts, v1.2 (2017)
- SWGDE: Best Practices for Forensic Audio, v2.5 (June 9, 2022)
- SWGDE: Best Practices for Enhancement of Digital Audio, v2.0 (August 21, 2025)
- NIST IR 8387: Digital Evidence Preservation: Considerations for Evidence Handlers (September 2022)
- Microsoft Support: Troubleshoot Windows Media Player Errors
Media Medic
Audio and video restoration for recordings that matter.