Page 24 - WBG July 2025

FEATURE

AI in the Courtroom:

How We Proved a Voice Was Cloned and

Screenshots Were Faked

By Fernando Fernández International Private Investigator & Certified Digital Forensic Expert CIG, LLC

In a case that may set the tone for how artificial intelligence is Step 1: Chain of Custody Breakdown – The Screenshots
treated in courtrooms moving forward, I had the opportunity to
serve as a digital forensic expert in what would become Puerto Screenshots are never conclusive digital evidence—yet they continue to
Rico’s first criminal case involving a voice cloned with AI used be used in courts around the world. In this case, there was no physical
as fabricated evidence. Alongside my forensic audio colleague extraction of the device from which the screenshots originated. Instead,
and our legal team, we successfully demonstrated that the key the complainant simply submitted image files, claiming they were from her
evidence against our client, Elizabeth Torres, had been digitally device.
altered and artificially generated—leading to a full Not Guilty
verdict. I requested a forensic image of the phone to verify metadata and origin.
No such image existed. In fact, the screenshots were submitted via a CD,
Elizabeth was facing up to 8 years in prison for allegedly copied from an unknown source. Worse, the phone was never turned over to
violating a protective order under Puerto Rico’s Law 54 on the defense for independent review, and the police had merely performed
Domestic Violence. According to the allegations, she had a drag and drop of the screenshots and generated a hash afterward,
made contact not with her ex-husband directly, but with his believing this would validate the files.
new girlfriend, which was also prohibited under the protective
order, as it included contact with partners, relatives, and close We also made mention that for the screenshots we used software to detect
associates of the complainant. changes in the metadata, where it was discovered that the file extension
claimed to be PNG, but in its internal structure it was JPEG. We verified the
This article is a behind-the-scenes account of how we achieved ELA (Error Level Analysis), the noise map, PCA (Principal Component
the acquittal, what forensic strategies we used, and what Analysis) and cloning detection, where we discovered, among many
lessons fellow detectives and investigators should draw in this other things, inconsistencies in the timestamp of the call that were not
new era where AI can now manufacture “truth.” compatible with the official call detail records provided by the phone
company.
The Case: A Call Log and a Voice Message This provided not only technical proof of manipulation, but a forensic

The core of the accusation relied on two pieces of evidence: roadmap for how to challenge digital evidence that lacks chain of
custody and original device access.
1. 2 screenshots showing a received call log from an unknown
number with a U.S. area code, which was later confirmed to
belong to Twilio—a platform known for hosting automated Step 2: Proving the Voice Was Cloned
communications.
The second piece of evidence was the audio clip in which the phrase
2. An audio file in which the phrase “Keishla, Keishla” was “Keishla, Keishla” was repeated on three different occasions
repeated on three different occasions throughout the throughout the 1-minute and 17-second audio recording. Though short, it
1-minute and 17-second audio recording, referring to the was presented as a direct and intentional violation of the protective order.
name of the new girlfriend. I brought in Lyanne Flores Báez, a certified forensic expert in acoustics
and phonetics, who is part of my investigative office and works under my
There were no texts, no video—only this combination of a visual direct supervision. Together, we conducted a detailed forensic analysis of
call log and a short voice snippet. Both the ex-husband and his the recording.
new partner claimed under oath that the voice in the audio
belonged to Elizabeth. Using advanced tools to analyze spectrograms, frequency distribution,
waveform behavior, and biometric vocal signatures, we identified
However, upon thorough analysis and reconstruction of the significant anomalies:
timeline, we demonstrated that there had been no active 3-way No breathing sounds
call on the day and time the audio was allegedly received. Our Abrupt transitions in tone
sequence analysis proved that the complainant was never part
of a conference call during that period, contradicting their claim Unnatural pacing and pitch
and raising serious doubt about the authenticity of the entire Irregularities in formants and in the fundamental frequency, both of
event. which were anomalous and inconsistent with natural human speech

22 W.A.D Beyond Global