Is it possibile to identify the CD Drive that burt a CD?
interesting!
I would say, possibly, but the probability is low.
I am think that the laser in each drive would uniquely "write" or burn the data. Combined with the drive spin & wobble uniqueness, I do not see why there could not be a reasonable elimination of drives that could or could not burn a CD.
I wonder what tool would be needed. Digital microscope and such for starters…
Well, looking at it another way…if you know the contents of the CD, then you may be able to find the system where they may have come from, particularly if the contents are an ISO file…
Are you trying to find the actual CD drive, or the PC?
Sector 0x10 generally contains info on software used to write CD, unless it is a UDF disk. It also has an area that is not defined for different identfiers.
Many systems will use the common software pacakges, so is far from unique.
Overall, I would say it is very difficult to say this PC wrote this CD. The only guide would be if the files, with the correct creation dates, were all found on the suspect PC, but this is not proof. Different creation dates (even when modified dates are the same) indicates that the file has been moved from a different system.
If you have a good idea of what PC burnt the CD, you can look for evidence of a CD being burnt at the time that the CD you have was burnt. If you are lucky, you may find a saved project file from Nero or Roxio showing the contents. You may have LNK files on the PC pointing to files on the CD. LNK files will also have a volume label which you can match to the CD.
What data, other than that being burnt goes on a CD?
The information on the CD will include details of software writing it. The rest of the information will be files, and file system information.
The file system data does depend on if it is CD-R, CD-RW, Joliet, UDF etc, single session, multi-session. Number of tracks, and starting location of tracks, type of CD.
I am not aware of any writing logs being added to CDs
In a manner that a Court would accept?
Nope.
For the heck of it?
Probably no way to be 100% accurate.
In a manner that a Court would accept?
Nope.
For the heck of it?
Probably no way to be 100% accurate.
If you had the computer and looked at the CD that was burnt and found
1. The same directory structure that existed on the CD as is on the computer
2. A saved project file in the CD burning software on the computer that matched what was burnt on the CD
3. The files on the CD have the same hash value and metadata as the files on the computer
4. The same folder structure on the CD as exists in the CD Burning folder on the computer
I think a combination of some of the above would go towards allowing you to testify to a reasonable degree of scientific certainty that you have the computer that burnt the CD.
A few months after the first question but…
It does appear that for DVD rather than CD, the answer is yes. The drive model and serial number is stored in the 'RMD in the last border'
For CDs, I think RID is the area to be investigated