I've been handed a VCD for a case that we've completed previously, and now have to try and associate it with the previously examined computers.
So far I have done the following
The heavily scratched disc was cleaned and imaged (as E01 and ISO)
The video files were extracted and repaired using VCDGear
Ascertained the disc does not contain videos on the computers
Checked the NeroHistory file for Nero 7 and determined the disc was not created using this.
Does anyone have any thoughts on other ways I could see if this disc was created from a certain computer?
Thanks in advance for any help that can be provided!
This would be an interesting study albeit this is no help for you now.
Hypothesis
CD/DVD burners when they "burn" CD/DVDs leave unique fingerprint in the process of burning.
That is, the writing laser darkens the dye in writable CD/DVDs in a unique pattern at the individual bit level.
I also pose that such uniqueness can be detected easier with write-once CD/DVDs, as opposed to write-many CD/DVDs. But, with write-many it maybe more precise - the melting and recrystallization of the phase change compound maybe more unique and consistent than the pits . . .
Look at the session header on the CD, you may well find a program name, version number and date in there. I'm not sure as I'm not at my forensic computer right now but there is a chance you might find a GUID or something for the actual burning device.