how to detect if a ...
 
Notifications
Clear all

how to detect if a CD-R was written in a particular computer

8 Posts
7 Users
0 Reactions
598 Views
(@yunus)
Estimable Member
Joined: 17 years ago
Posts: 178
Topic starter  

We were sent 150 CDs and a computer with two CD writers on it. We are asked if we can detect whether or not these CDs were written in that particular computer.

We examined the computer and saw that there is Nero installed, and checked number of times it was run, it is just 13.

We also examined the CD sectors. We got some information from the sectors, like some long numbers or CD labels "NEW", however these do not seem enough to say that these CDs were written in this computer.

Does CDs store data about which software and which writers were used during creation? Or anything else that might be relevant to linking it to the computer used during its creation?


   
Quote
(@research1)
Estimable Member
Joined: 17 years ago
Posts: 165
 

I remember looking into this last year some time, so apologies my memory is very hazy, but I'm sure there was a code at the start of the allocated data on DVD/CDs that represent what software was used write the data. I don't think I could find any information on actual individualising exactly where it came from. That's as far as my research went.

Regards,


   
ReplyQuote
(@douglasbrush)
Prominent Member
Joined: 16 years ago
Posts: 812
 

I would definitely search through the forum; subject has been looked at prior.

Also, a good book on the subject in general
http//www.infinadyne.com/cddvdforensicsbook.html


   
ReplyQuote
(@forensicakb)
Reputable Member
Joined: 16 years ago
Posts: 316
 

I'm curious as to your experience level OP.


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

Ow, comeon, the .iso extension is because the way a CD/DVD is written is a "standard", ISO9660
http//en.wikipedia.org/wiki/ISO_9660

The specifications are available as ECMA-119
http//www.ecma-international.org/publications/standards/Ecma-119.htm

Newer version, so-called ISO96601999 is available here
http//www.pismotechnic.com/cfs/iso9660-1999.html

Point 12.3.1 lists the needed fields, that include that of "Application Identifier".

These are easier
http//d3s.mff.cuni.cz/~ceres/sch/osy/slides/ch05s03s01s05s01.php
https://alumnus.alumni.caltech.edu/~pje/iso9660.html

Get the cdrecord package
http//cdrecord.berlios.de/private/cdrecord.html

Try using isoinfo.exe

jaclaz


   
ReplyQuote
(@mscotgrove)
Prominent Member
Joined: 17 years ago
Posts: 940
 

Is it just CDs because DVDs often have the unique serial number of the DVD drive written to the disk. I am not aware of the same for CDs.


   
ReplyQuote
(@Anonymous 6593)
Guest
Joined: 17 years ago
Posts: 1158
 

Does CDs store data about which software and which writers were used during creation? Or anything else that might be relevant to linking it to the computer used during its creation?

There's nothing automatical. As already mentioned, if the CD were mastered on the computer, the software used (Nero, say) may have populated the application field in the primary volume descriptor. However, the only application strings I have seen so far are these

NERO - BURNING ROM
NERO BURNING ROM
NERO_-_BURNING_ROM
NERO___BURNING_ROM

and that's not very useful. Actually, this field is intended to state what application is needed to process information in the first 16 sectors – so on most CDs, you would not find any information here, as the first 16 sectors are left empty. (I have noticed some kind of data in the very last sector before the primary volume descriptor, which I suspect to be a Nero artifact, but I haven't tried to find out what it means. I suspect it may help identify a Nero mastering file, though. )

However, if the CD's were not mastered, but burned directly from .ISO images obtained from somewhere else, no information is added at this level (at least I have not found any).

You may want to check if the CD writers produce a recognizeable RID. That's an identification code which some equipment adds – it's added at the very lowest of CD-levels, in one of the subchannels, where data such as track numbers and clock data and CD-TEXT is stored. RID should be unique, so if you find that one of the units does write a RID, and you find that RID on the CDs, you have connected the two pretty strongly.
Unfortunately, it seems that comparatively few CD writers do write RID information. You need special software to extract this information, though. Haven't used the Infinadyne software mentioned, but I think that is able to extract RID information, if present.

(Note I mean CD, not DVD. If you meant DVD, this information may not apply. RID, for instance, is present, if at all, only on writeable CD.)


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

The RID (Recorder IDentification) is supposedly mandatory
http//en.wikipedia.org/wiki/Optical_disc_drive#Recorder_Unique_Identifier
https://www.ip.philips.com/services/?module=IpsLicenseProgram&command=Print&id=20
but while the SID is there since 1994 , the adoption of RID is more recent and AFAIK mostly limited to Audio CD's recorded on Audio devices
http//www.infinadyne.com/cddvd_diagnostic.html

RID The acronym for Recorder Identification. It is written to music CDs recorded on standalone CD recorders used with audio systems.

So I doubt that it will be of any use in this case.

jaclaz


   
ReplyQuote
Share: