I'm having a couple of questions about forensics on a CD-RW disc.
I've been using IsoBuster to gather some infos about the disc. Here is what I've been able to find so far
- The disc has been burnt with Nero.
- There are 6 sessions on the disc.
–> Session 1 and session 2 each have a single track, and those tracks have the same name "000702_1552".
–> Session 3 has a single track in audio format.
–> Session 4 has 2 tracks, both in audio format.
–> Session 5 and 6 each have a single track, and those have the same name "000905_2055".
- All the sessions on the disc are stated as "Closed".
Here are my questions
- How come can 2 sessions have the same name when the name is supposed to be a timestamp of when the Nero project was created?
- Also, those sessions with the same track name, their content is not the same. How is that possible?
- Aside from assuming that the track name is a timestamp, is there a way in IsoBuster (or another tool) to figure out the date and time when the drive / session was burnt ?
- When looking in IsoBuster, how should I interpret the "Modified Date" ? Is this date modified when the disc is burned ?
Thanks.
How come can 2 sessions have the same name when the name is supposed to be a timestamp of when the Nero project was created?
Um … sessions don't have names, nor do tracks. What you are seeing is probably not what you think you are seeing.
Actually, I can't imagine what you *are* looking at … a screendump would help. Alternatively, get in touch with Peter Van Hove at Smart Projects – my impression is that he's very good at fielding support questions. (The ISOBuster help file is also worth perusing.)
Or … are you looking at ISO or UDF volume names? In that case, they can be called just about anything, just as simultaneously mounted Windows volume may have identical names. And if session 2 is an update of session 1 it *would* have the same volume name.
- Aside from assuming that the track name is a timestamp, is there a way in IsoBuster (or another tool) to figure out the date and time when the drive / session was burnt ?
Quite unlikely … as far as I know there is no data field on a CD-RW where that information must appear. There are fields that are left for the manufacturer to specify, but as a CD writer doesn't have any idea of 'global time', it seems unlikely to find time recorder there.
You may find information as to when the session was mastered, which is not the same. However, that depends on the mastering program. If you know this was done by Nero, you just look at what it does by default. (As far as I recall, some versions may do a date_time name when they don't repeat the previous volume name specified. )
(Added Though, if this is ISO-9660 file systems, you should look at the Volume Descriptors, and look for the Volume Creation Date and Time, which might be close enough. The ECMA-119 document is a free version of that standard, and downloadable off the net.)
When looking in IsoBuster, how should I interpret the "Modified Date" ? Is this date modified when the disc is burned ?
Where exactly? In the file listing? For an ISO-9660 file system, that corresponds to the file 'Recording Date and Time' field, and remember that ISOBuster may convert it to local time dependning on your settings. That is generally the mastering date, in which case all files have very closely related timestamps – and if mastering is done immediately before burning, you may have a burn timestamp. If times are not closely related, the mastering program probably applied its own rules … so you will have to examine what it does. It may take 'Last Write' timestamp from the original file, for example.
Similar argument for UDF file systems.