Notifications
Clear all

DVD-R Forensics

3 Posts
3 Users
0 Reactions
740 Views
(@twjolson)
Honorable Member
Joined: 17 years ago
Posts: 417
Topic starter  

I got a DVD-R on a case, and my knowledge is quite low on the subject, and documentation is quite hard to find.

I am trying to determine which program created/burned the DVD-R. And if possible, tie it to a specific computer.

I know that LS 0x10 can sometimes contain the name of the program that created the DVD. When I look at that spot, it just says "BEA01".

Other strings I can't discern are "NSR03", "TEA01". Can anyone shed some light on what these mean?

There is the string "*Microsoft Windows", which makes me think it was done via CD Burning in Windows, but I'd like something more solid than a guess.


   
Quote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

I got a DVD-R on a case, and my knowledge is quite low on the subject, and documentation is quite hard to find.

I am trying to determine which program created/burned the DVD-R. And if possible, tie it to a specific computer.

I know that LS 0x10 can sometimes contain the name of the program that created the DVD. When I look at that spot, it just says "BEA01".

Other strings I can't discern are "NSR03", "TEA01". Can anyone shed some light on what these mean?

There is the string "*Microsoft Windows", which makes me think it was done via CD Burning in Windows, but I'd like something more solid than a guess.

The BEA01 is standard ECMA for "Beginning Extended Area Descriptor"
The NSR descriptor is normally NSR02 or NSR03, again standard ECMA, respectively for 167/2 and 167/3.
The TEA01 is standard ECMA for "Terminating Extended Area Descriptor"
Not that hard to find wink
www.ecma-international.org/publications/files/ECMA-TR/TR-071.pdf
www.ecma-international.org/publications/files/ECMA-ST/Ecma-167.pdf

jaclaz


   
ReplyQuote
(@mscotgrove)
Prominent Member
Joined: 17 years ago
Posts: 940
 

Sometimes there is a field in the 'hidden' DVD headers that has the serial number of the DVD writer. I have not seen it on all DVDs.

The demo of my software will display these field using Main Functions/tools/dvd properties. Only certain fields work with certain combinations of DVD and drive. Thus you amy see the message 'Illegal field in CDM' For 5 mins work it is worth a look - www.cnwrecovery.com

The field to investigate is 'RMD in last border'


   
ReplyQuote
Share: