qwertyuiopasdfghjklzxcvbnmqwerty uiopasdfghjklzxcvbnmqwertyuiopas dfghjklzxcvbnmqwertyuiopasdfghjkl

Transcription

1 qwertyuiopasdfghjklzxcvbnmqwerty uiopasdfghjklzxcvbnmqwertyuiopas dfghjklzxcvbnmqwertyuiopasdfghjkl CD-R/RW and DVD+-R/RW Media Analysis zxcvbnmqwertyuiopasdfghjklzxcvbn mqwertyuiopasdfghjklzxcvbnmqwer Digital Forensics Fall /5/2006 tyuiopasdfghjklzxcvbnmqwertyuiop Nico Marrero asdfghjklzxcvbnmqwertyuiopasdfghj klzxcvbnmqwertyuiopasdfghjklzxcv bnmqwertyuiopasdfghjklzxcvbnmq wertyuiopasdfghjklzxcvbnmqwertyu iopasdfghjklzxcvbnmqwertyuiopasd fghjklzxcvbnmqwertyuiopasdfghjklz xcvbnmqwertyuiopasdfghjklzxcvbn mqwertyuiopasdfghjklzxcvbnmqwer

2 1 CD/DVD Operation 1.2 mm of polycarbonate plastic and a film of laquer (usually with a label) sandwich a thin layer of Super Purity Aluminum (or gold, for data longevity) in Compact Discs (CDs). The data in a CD is stored in tiny pits in the top of the polycarbonate plastic layer in tightly packed spirals. Figure 1: CD Cross-Section When the CD reader s 780 nm wavelength laser hits the pits and lands (spacing between pits), the reflected light hits an optical sensor or misses it depending on whether it hit a pit or a land. The pits and lands do not reflect the binary data, however. The raw data is encoded using Non-Return-to-Zero, Inverted encoding and Eight-to- Fourteen modulation and finally Cross-Interleaved Reed-Solomon Coding. DVDs (Digital Versatile Discs) are much like CDs in that they have pits and lands that are read by a laser. However, the pits and lands are much smaller and the tracks are much thinner than CDs. The laser used to read the information is also much smaller (640 nm wavelength). DVDs use a different encoding scheme than CDs and much more efficient error correction, allowing them to hold much more data (4.7 Gb). Dual layer DVDs can hold almost twice the information (pits have to be longer), although there can be a pause of as much as two seconds when readers switch between layers. There are also double-sided DVDs that hold information on both sides of the disc.

3 2 CD/DVD Writing Figure 2: CD pit spacing vs DVD pit spacing For Writeable CDs (CD-Rs or CD-Recordable discs), instead of pits and lands, they have a photosensitive dye underneath the reflective metal layer. The dye begins as transparent, but the recording laser causes the dye to become opaque. When the reading laser hits the transparent sections of dye, the light reflects onto the optical pickup. When it hits the opaque sections, the light is absorbed. This is why CD-Rs are compatible with stamped CDs. Writeable DVDs are more complex due to the format wars. Though physically they are similar to writeable CDs, there are three competing formats for writeable DVDs: DVD-R/RW, DVD+R/RW, and DVD-RAM. DVD- and DVD+ are very similar formats, while DVD-RAM is even physically different from the other two (it has a disc caddy). There are three methods of writing CDs/DVDs: Disc-At-Once, Track-At-Once, and Packet Writing. Disc-At-Once In this method, all of the data is written to the media and the media is closed (meaning no more data can be written to it). This method allows extra data to be written to the disc in the form of hidden tracks (which can only be accessed by rewinding from the first track) and in pre-gaps that occur between tracks. Track-At-Once In this method, data is written one track at a time and the media is left open to allow more data to be written later. This is typically how audio+data CDs are created. Packet Writing In this method, files are written to the media in packets, allowing files to written at multiple times and allowing files to be hidden (in the case of WORM) or erased (in the case of RW).

4 3 CD/DVD ReWriting Rewriteable CDs and DVDs, instead of a dye, use a mixture of silver, indium, antimony and tellurium. When heated to a certain temperature the mixture cools in a crystalline form. When heated to a higher temperature, it cools amorphous. In this way, the media can be written over again and again. CD/DVD Filesystems ISO 9660 The ISO filesystem was the first to be used with CD media. Filenames are restricted to [0-9A-Za-z_]*. Directory names can be a maximum of eight characters and can only be eight directories deep. CDs carry a Table of Contents (TOC) that holds track information (up to a total of 99 tracks). The rest of the CD is split between the system use area and the information area. Data is stored in the information area while the system area acts like the boot sector of a hard drive. The CD also has eight subchannels (P through W) that are used to store information other than the main audio or data. The system area is divided into two parts: the power calibration area (PCA) and the program memory area (PMA). The PCA is used to calibrate the laser for writing. On every calibration a bit is set in a counting area. There can be up to 99 calibrations. In the PMA, data is stored to record starting sectors for data tracks or start and end times for music tracks. The information area is divided into three parts: the Lead-In, Program Area, and Lead-Out. The Lead-In contains digital silence in the main channel and the TOC in the q-subchannel. The Lead-Out contains only digital silence and marks the end of the CD. The Program Area contains the actual data (with a lot of encoding). ISO 9660 is not good for rewriteable media or even for multi-session WORM media because each file must have its location set ahead of time to create the Path Tables and Volume Descriptors it uses. The standard must also be constantly rewritten as new forms of data are becoming commonly written to the media (including audio, data, multimedia, etc). So another standard was introduced to overcome these problems. Universal Disc Format (UDF) UDF is a newer standard used to replace ISO 9660, though it maintains backward compatibility with it. UDF (after version 1.5) has three flavors: Original, Virtual Allocation Table (VAT), and Spared. Original This flavor is used on any media that supports random read/write access. This includes hard drives. Like other filesystems (FAT), directory entries point directly to the blocks of file contents.

5 4 VAT This flavor was created for WORM media (both CD and DVD). With Original UTF (as with ISO 9660) all of the data would have to be mastered before writing to WORM media since writes can only occur once and must be incremental. VAT uses an allocation table to remap physical blocks that are modified (or deleted ) so that a WORM disc can be used much like a hard drive. Spared Sectors on rewritable media tend to wear out over multiple write cycles (typically 1000). To combat this, this flavor of UDF uses a Sparing Table to remap worn out sectors (effectively load-balancing sector rewriting). This flavor looks identical to the Original flavor until sectors begin wearing out. CD/DVD Data Recovery Much of the information on data recovery is proprietary and not easily accessible. Especially specifics on how to perform data recovery. The tools that are sold are usually provided free to view recoverable files, and then require a license to actually extract and recover the files. Available commercial tools are listed in a later section. The differing roles (Corporate IT, Government IT, Forensic Investigator) have a very similar function in the context of CD/DVD media analysis. A Forensic Investigator would have the additional task of using tools that create media images (in this case most likely the.bin/.cue or.img file formats, which contain raw dumps and don t do anything fancy to shrink the image size) to be sure that data is consistent and unchanged. WORM Data Recovery In write-once media, data cannot be erased. If files are deleted from WORM media, they no longer appear in the TOC, but the file data itself is still on the CD. So using (or creating) tools that do not bound themselves with the CD/DVD TOC can allow a person to recover deleted files in WORM media. In the case of multiple sessions, each session s TOC contains pointers to previous sessions, so even though the final session is viewable through the main TOC, all previous sessions are accessible. Rewritable Data Recovery There are two different ways to delete data on a rewritable disc: Full Blanking and Fast Blanking.

6 5 Full Blanking Data on rewriteable discs can be deleted permanently as the entire CD/DVD can be annealed, which takes a long time as each sector on the media must be written. However, no references could be found that discussed potential ways to recover data from fully blanked media. Fast Blanking To save time, data can be erased in a manner similar to erasing files on many filesystems. The file data still exists, but references to the file are deleted. In rewritable media, erasing the entire media can be as fast as erasing the TOC, pregap, and PMA. ALL the data on the disc is still present, but the disc appears blank to a reader. Usually, this means that the first sectors of data are gone, but after about 300 sectors, data recovery can begin. If a rewriteable media is formatted using the VAT UDF filesystem, then data can be recovered in much the same way described in the WORM Data Recovery section. Physically Damaged Data Recovery Because the information in CDs and DVDs is contained inside the media and not on the surface, the plastic layer can be removed and replaced to get access to the data beneath. However, scratches in the label side of the disc are more likely to cause damage to the data than scratches in the shiny side. Companies like Skippy Disc ( can perform CD/DVD repair for a price ($ $7.00 per disc). CD/DVD Data Recovery Tools Here are a smattering of the many, MANY data recovery tools available. I was unable to find any that were completely free. IsoBuster ( $29.95 Isobuster touts data recovery from all possible CD and DVD formats. All data access, media access, data gathering and interpretation is done independently of the OS. Also works with image files. Some of the data recovery functionality is free (like ISO 9660 recovery) and some requires the licensed version (like UDF data recovery). Multi Data Rescue ( $39.95 This program recovers data from CDs, DVDs, and Digital Media (USB keys, PDAs, Phones, Memory Cards, etc). There are cheaper versions available for just CD or DVD data recovery.

7 6 CD Roller ( $29.50 Like the aforementioned tools, CDRoller works on CDs and DVDs in multiple formats and multiple filesystems. References Wikipedia: How Stuff Works: PC Tech Guide: CGSecurity PhotoRec: DVD Forum: SkippyDisc: IsoBuster: NalTech: CDRoller: