Extracting the dialed number from phone record

I ran into a prank call today on youtube, and the authors didn’t care about removing the sound of the dialed number. Comments were arguing that the number could be retrieved. Of course it can: Everyone knows you can simply play that record to redial the number and generating DTMF tones is easy (I wrote my own phone-book application when 15, dialing numbers from my soundblaster card). What about the reverse process then ? Let’s try:

Extracting and locating the DTMF tones within the record. I used Audacity:

According to Wikipedia, here’s the matrix for the DTM Frequencies:

DTMF keypad frequencies (with sound clips)
1209 Hz 1336 Hz 1477 Hz 1633 Hz
697 Hz 1 2 3 A
770 Hz 4 5 6 B
852 Hz 7 8 9 C
941 Hz * 0 # D

Using the Spectrum analysis module on the selected sample and with the appropriate parameters, you can clearly see the two tones pikes:

Here, we can identify the 770Hz + 1336Hz dual tones revealing the ‘5’ number. Getting the full number is just a matter of minutes :)

I used the Barlett Window with 512 Bytes sample and displayed using the logarithmic scale (as we look for low freq pikes).

Leave a Reply