If it's just a plain DVD why not get a DVD-drive which is not able to write DVDs? Check eBay or so ).
Might not be able to read certain CD/DVD file systems or open sessions.
It's been a while since I checked, but ability to read open sessions and of course other file systems is a software function, not a hardware one.
Hence get a DVD/CD reader and appropriate software/OS for the FS you're dealing with and you're set.
If it's just a plain DVD why not get a DVD-drive which is not able to write DVDs? Check eBay or so ).
Might not be able to read certain CD/DVD file systems or open sessions.
I don't think so. 😯
You make a dd-like copy of the CD/DVD, there shouldn't be any problem with open or closed sections, a CD/DVD has sectors, like any other block device.
jaclaz
Why not use a DVD-rom drive.
Also, DSI out of tennesee makes a software WB that I use regularly on Vista. I have validadted it myself, but make sure you do also.
http//
Good luck
Ok, first off, thanks so much for responding everyone! I've been busy, so I haven't had time to check back in.
I will check out ISOBuster, CD/DVD Inspector, and DSI! The disc isn't DVD-RAM, there's not rectangles on the disc, so I believe I'm safe there. Other than that, I'm not sure what the disc is because my exhibit officer has it and hasn't responded to my emails. I'm using Windows XP and I did turn autoplay off )
We're meeting tomorrow to do the image of the disc, so hopefully it'll work alright. I feel a bit silly having asked such a beginner question, but thanks again for answering. I think I might have learned more reading this thread than I did in class all week!
Also, DSI out of tennesee makes a software WB that I use regularly on Vista. I have validadted it myself, but make sure you do also.
Also you don't need a several Mb application to change a Registry key to block USB write through software under XP SP2 or later
http//
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=559
http//
http//
http//
jaclaz
I have had opportunity this morning to check back with the book CD and DVD Forensics written by the developer of CD & DVD Inspector Paul Crowley. The version is from 2007 so it is a little old now but it says this -
"You must use a writer-type device because reader devices do not access open sessions on discs. Any incomplete drag and drop discs would not be accessible with a reader. Worse still, a multi-session disc that has been closed at least once and written to again with drag and drop writing software will only show the finalised content; anything added after that would be invisible."
He goes on to say that" it is not necessary to use a write-blocker device" and explains this in further detail.
I haven't got any practical experience to validate this but in the absence of some update or other information from somebody that knows otherwise I will rely on what Mr Crowley says.
H
I haven't got any practical experience to validate this but in the absence of some update or other information from somebody that knows otherwise I will rely on what Mr Crowley says.
The same info is given on the Infinadyne FAQ's (obviously)
http//
This doesn't mention the *need* for a writer
http//
Correctly handles data from 'tricky' disks (such as open session HFS, multi session)*.
* We realized quickly that allowing the investigator to choose his/her own forensic imaging tools would be best. Listening to analysts, we hear a lot of support for DD. So, by default, the CD/DVD Imager attempts an image with DD and if that fails it tries cdrdao (which handles multi-session discs better, and allows for exact duplicates to be burned from the image & toc file). However, it is possible for someone with scripting knowledge to change which programs image discs in the input hopper - it is up to these programs to create images compatible with forensic tools. Many tools happen to already recognize DD.
And as well this doesn't
http//
With Isobuster technology built in, FTK Imager Images CD's to a ISO/CUE file combination. This also includes multi and open session CDs.
I could not find any reference in FTK docs about the need of a writer, so I guess it remains a question not comletely answered.
From what I can understand from Isobuster
http//
the choice of using a writer is mostly because (as re-known) writers tend to have a more "accurate" mechanics than (cheap) readers.
However, both the Infinadyne and the Isobuster references mention something we didn's discuss till now 😯 , which is getting data from a quck erased RW media
http//
This
http//
confirms my "generic" view of a CD/DVD as a block device, but experiments should be carried to make sure.
jaclaz
If it's just a plain DVD why not get a DVD-drive which is not able to write DVDs? Check eBay or so ).
Might not be able to read certain CD/DVD file systems or open sessions.
It's been a while since I checked, but ability to read open sessions and of course other file systems is a software function, not a hardware one.
Hence get a DVD/CD reader and appropriate software/OS for the FS you're dealing with and you're set.
"You must use a writer-type device because reader devices do not access open sessions on discs.
That was what I was referring to in my earlier post.
The OP completely failed to mention the actual type of media, actual OS he plans to use AND hardware he has available, thus anything posted here is more a shot in the dark than an actual answer to any actual question.
wink Any why I felt that it was best to think that there was something that a RO drive might not be able to access
a_kuiper! yup its easy….