Need advice on the easiest way to image an open session cd.
Encase won't do it, as we know and hasn't been able to, even in v7!
Is there an open source/freeware solution?
I am aware FTK can do it but need a quick, cheap solution unless of course that is the only solution.
Using Encase v6.18 so a format that works with that would be ideal.
You could try IsoBuster. It's not free (aside from the trial) but it's cheaper that FTK.
It is probably not an issue but you do require a CD or DVD drive that is RW compatible. (ie CD RW or DVD RW) Unless you have a very old one all current ones I have seen are.
Some CDs (and DVDs) though will not be read without special hardware.
Is the CD a CD-R or CD-RW?
You can try the demo of my software to see if it will view the sectors, this will indicate if your hardware setup is compatible with the CD.
In terms of imaging, use FTK Imager. That will gather everything.
For analysis, I'd go ISOBuster. It contains just a little bit more CD-specific info than FTK does.
But, truth be told, I don't have a ton of CD exam experience.
Thanks all for your replies.
Using ISO Buster and FTK Imager I am facing the same problem, when adding the RAW image, the media name appears but no content.
I am thinking this is because it is an open session and therefore no 'end' of the cd is given.
Can you actually view sectors of data, on the disk?
Important sectors on a CD start at 0x10, and then it depends on the format. There is normally data in 0x100.
If you know how data should be on the CD, try some sectors near the end (sector is 0x800 bytes long).
If it is a UDF disk, the most important sector is at the end, which points to the directory.
Is it a CD-R or CD-RW. If RW has it been reformatted? This could leave a disk that looks blank, and most software will not see the previous data.
I can see the CD and its content fine through Windows Explorer, I just want to image it to add it into Encase, via Add Raw Image, and examine it.
I have tried ISO Buster and FTK Imager and they both do the same, image it but when you add them to Encase there is no content.
Essentially, the above software is doing what is asked of it, its the user that is failing to ask it to do it right!
I am thinking I am missing something, but what?
Its a CD-R and the movie on it plays fine through Windows Explorer..
Should I be acquiring the whole disk or just the open session?
You can only aquire the written sectors. Trying to read a blank sector will fail, and need to be skipped / padded.
I do not understand your comment about No content. If the CD plays, then everything sounds physically OK, and several software packages should produce if nothing else a sector by sector image of the disk.
The CD plays the movie through Windows Explorer, no problem.
When I acquire the CD the movie doesnt appear as content, just the CD, the CD name and then in the folder that was created to contain the movie, nothing just unallocated clusters.
I am thinking its down to the way I am adding it to Encase.
After all, imaging software images what it sees, thats why its called imaging!