Hi guys,
Got a couple of CD's on a current job. (CD's alone - nothing more so no machine strings to tie to).
I'm just after any tips or tricks anyone might have for discovering the disc creators.
Obviously i've searched the discs for very short form of suspect names for any matches, to no avail. No documents were found with any data carving etc.
So if someone has a great trick for finding a scrambled string with the creator of the disc hidden somewhere that'd be handy!
(I realise this is pretty unlikely - but thought it was worth an ask just in case wink )
Depending on the format of the disc you can find several timestamps, volume info, publisher (not what you are looking to find), data preparer (what software wrote to the disc), etc. These are all very useful when you have a computer to compare them to, not so useful when you just have a stack of discs to examine.
(Now it lets me reply after a day or so of forum weirdness…)
Yeah i found the usual stuff like that - was just a last gasp check in case someone had some nifty trick that i hadn't heard of before i call it a writeoff in that respect wink
Rich,
Many manufacterers of CDs put batch/serial numbers on them. I just thought it worth a mention as it can be a way of proving one CD with relevant evidence on and one CD with the suspect's personal files on were stamped out on the same machine, in the same factory, in the same minute of the same day.
Not quite the answer you were looking for but as I say, just thought it was worth a mention.
Steve
Cheers Steve,
Yeah no use on this one, but always worth noting for the future.
(As you mention 'stamped' out, i presume these details you refer to are the batch/serial numbers from large scale pressing machines? - Rather than discs like these home CDRWs.)
Rich,
I mean physically made as opposed to mass recorded. So blank CD-R and DVD-R, where they were made and when.
Probable chances are 5 CD-Rs made in the same minute on the same machine were sold in the one box and "those 3 are mine but the others I got off 2 different blokes down the pub" might not be true.
Steve
Ah, i see your logic now. Fair point )
Hi guys,
Got a couple of CD's on a current job. (CD's alone - nothing more so no machine strings to tie to).
I'm just after any tips or tricks anyone might have for discovering the disc creators.
Must confess that I am a bit confused after reading the thread. If I understand your question correctly Rich, you want to know which individual wrote the data on the recordable CDs in your possession? I am also guessing that there is no meta-data in any of the files on the disks that could help out e.g Microsoft Office Files? Apart from that , in the normal course of events, the identity of the person burning the data to the disk isn't recorded on the disk (AFAIK). If there is no file meta-data to help you out I think you are out of luck.
Hi
I'm also looking at a case which only involves CD's. when looking at the cd in encase i see what the disc name is and what program was used to make it, but am i able to get any more info from it (dates, author etc)??? If so at what offsets??
Cheers
Hi
I'm also looking at a case which only involves CD's. when looking at the cd in encase i see what the disc name is and what program was used to make it, but am i able to get any more info from it (dates, author etc)??? If so at what offsets??
Cheers
I believe that the disk name is actually a volume identifier, this can be assigned by the person creating the disk volume or more typically is assigned a default name by the burning software used to create the volume.
In terms of getting further information, there is a lot you can do. ISOBuster and CD/DVD Inspector are used a lot. If you are on a budget, then there are alternatives.
Linux way
The following programs can be used with a variety of switches (use the "man" pages)
to get you information about the ATIP data, Primary Volume Descriptor, number of sessions and starting offsets of them, directory listings and associated MAC times, volume names and volume creation dates and disk manufacturer.
readcd
cdrecord
isoinfo
Windows way
There is a little used feature within Nero burning suite to get you the "Enhanced Disc Information".
This will give you most of the above information. To use this feature, follow these steps
Place suspect CD in your CD Rom
Fire up Nero
Depending what package you have, bring up the "Add data to your disc" window, (with my package I have to click on the "Make Data CD" radio button)
At the bottom of your window you have 5 radio buttons, click on the radio button labelled
"More>>". This should expand the window to show 5 more radio buttons at the bottom.
Click on the radio button labelled "Disk Info".
This will bring up a new window showing basic information such as the number of sessions and size of data on disk. To get the enhanced disc data and Volume Descriptor Info
Hold down "Shift" & "Ctrl" together and click on the "Refresh" radio button in your "Disc Info" window. The enhanced info will then be presented in a new window, you can save this data to text file.
BTW, using the above method or Linux cdrecord command with the -atip switch you can get the make and serial numbers of a DVD recorder used to burn a DVD-R, it does not work with any of other format of DVD (AFAIK).
Hope this helps!