
At a Glance
320 Pages
22.23 x 17.15 x 2.54
Paperback
RRP $80.95
$77.75
or 4 interest-free payments of $19.44 with
 orÂShips in 5 to 7 business days
CD and DVD Forensics is a how to book that will give the reader tools to be able to open CDs and DVDs in an effort to identify evidence of a crime. These tools can be applied in both the public and private sectors. Armed with this information, law enforcement, corporate security, and private investigators will be able to be more effective in their evidence related tasks. To accomplish this the book is divided into four basic parts: (a) CD and DVD physics dealing with the history, construction and technology of CD and DVD media, (b) file systems present on CDs and DVDs and how these are different from that which is found on hard disks, floppy disks and other media, (c) considerations for handling CD and DVD evidence to both recover the maximum amount of information present on a disc and to do so without destroying or altering the disc in any way, and (d) using the InfinaDyne product CD/DVD Inspector to examine discs in detail and collect evidence.
| Foreword | p. xxi |
| Physical Characteristics of CD and DVD Media | p. 1 |
| CD Features | p. 4 |
| CD Sizes and Shapes | p. 6 |
| CD and DVD Types | p. 7 |
| CD and DVD Colors | p. 8 |
| CD-R Dyes | p. 9 |
| Information Storage on CDs and DVDs | p. 11 |
| CD and DVD Organization and Terminology | p. 12 |
| Border Zone | p. 12 |
| Lead In | p. 13 |
| Lead Out | p. 13 |
| Philips CD Text | p. 13 |
| RZone | p. 14 |
| Sector | p. 14 |
| Session | p. 14 |
| Sony CD Text | p. 14 |
| TOC | p. 14 |
| Track | p. 14 |
| CD and DVD Sectors | p. 15 |
| R-W Subchannels | p. 16 |
| CD and DVD Differences | p. 19 |
| CD-ROM Manufacturing Process | p. 20 |
| Inside a CD-ROM Drive | p. 23 |
| External Interfaces | p. 26 |
| Drive Firmware | p. 27 |
| CD and DVD Logical Structure | p. 29 |
| Writing to a CD or DVD | p. 30 |
| Logical File Systems | p. 32 |
| CD and DVD File Systems | p. 35 |
| Red Book Audio | p. 35 |
| HSG | p. 36 |
| ISO 9660 | p. 37 |
| Joliet | p. 39 |
| Rock Ridge | p. 40 |
| UDF | p. 43 |
| HFS | p. 46 |
| HFS+ | p. 47 |
| El Torito | p. 47 |
| Space Allocation by CD and DVD File Systems | p. 48 |
| Disc Accessibility Problems | p. 50 |
| ISO 9660/Joliet File Systems | p. 50 |
| UDF File Systems | p. 51 |
| Other File Systems | p. 51 |
| Forensic Binary Images | p. 53 |
| Reproducing Forensic Images | p. 55 |
| Collecting CD and DVD Evidence | p. 57 |
| Recognizing CD and DVD Media | p. 58 |
| Collection Considerations | p. 58 |
| Marking Discs | p. 59 |
| Transporting Discs | p. 60 |
| Documenting and Fingerprinting Discs | p. 61 |
| Officer Safety | p. 62 |
| Preparing for Disc Examination | p. 63 |
| Forensic Hardware | p. 64 |
| Forensic Software | p. 65 |
| Forensic Workstation | p. 66 |
| Validation | p. 67 |
| Disc Triage | p. 67 |
| CD/DVD Inspector - The Basics | p. 73 |
| CD/DVD Inspector Installation | p. 74 |
| CD/DVD Inspector Facts | p. 74 |
| Getting Started with CD/DVD Inspector | p. 75 |
| Data Window Usage | p. 80 |
| Disc Memory | p. 81 |
| Useful Tools | p. 83 |
| Analysis | p. 83 |
| Compute Disc MD5 | p. 83 |
| Compute MD5 Hash | p. 84 |
| Disc Map | p. 84 |
| Disc Report | p. 84 |
| Hardware Information | p. 84 |
| Scan Files | p. 84 |
| Sector Display | p. 84 |
| TOC | p. 85 |
| View Image | p. 85 |
| Write Image File | p. 86 |
| Searching | p. 86 |
| Scan Files | p. 87 |
| Producing a Forensic Image | p. 92 |
| Copying Files from the Media | p. 95 |
| User Preferences | p. 96 |
| Options Settings | p. 96 |
| Remove Version Marker from Files | p. 97 |
| Show Analysis File Details | p. 97 |
| Save Window Position | p. 98 |
| Sort Initial Display by Name | p. 98 |
| Accept All Errors without Prompting | p. 98 |
| Always Prompt for Filename on Copy | p. 99 |
| Force-intensive UDF Examination | p. 99 |
| Keep Duplicate Files from UDF Examination | p. 99 |
| Automatically Examine Disc at Startup | p. 100 |
| Enable Special Features | p. 100 |
| Recover without Prompts | p. 100 |
| Show Extents in Disc Reports | p. 101 |
| Disable Disc Memory Feature | p. 101 |
| Forensic Use | p. 101 |
| Use 64-bit .zip Extensions for .zip Image Files | p. 101 |
| Disc Memory Settings | p. 102 |
| Keep Last Discs in Disc Memory | p. 102 |
| Empty Button | p. 102 |
| Click to Delete a Single Item | p. 103 |
| Disc Memory Catalog | p. 103 |
| The Analysis Tool | p. 103 |
| name File System in Track nn Recorded as Part of | |
| Session nn | p. 104 |
| nnnnn Sectors are Used Out of nnnnn Available Sectors | p. 104 |
| type (media) load nnnn at Oxnnnn from Sector nnnn | p. 104 |
| A Properly Written Post-gap was Found For This Track | p. 105 |
| All Linked Files (nnnn) in this Session Came from Session nn | p. 105 |
| Application Identification | p. 105 |
| ATIP Reference Power = nn | |
| Reference Speed = nn | p. 106 |
| Blank Disc with nnnnn Free Sectors | p. 106 |
| Bootable Disc Information Found, Boot Catalog at Sector nnn | p. 106 |
| Bootable Media from company, platform=platform | p. 106 |
| The CDDB Key for this CD is xxxxxxxx | p. 106 |
| Data Preparer Identification: ssssssss | p. 107 |
| Disc is a DVD-kind Type is type | p. 107 |
| Disc Manufacturer: ssssss Type: ssssss | p. 107 |
| DVD Manufacturer is ssssss | p. 107 |
| Error nnn in Manufacturer Determination, Manufacturer Information Not Available | p. 107 |
| Error Reading Boot Catalog, Sense=0xnn 0xnn | p. 108 |
| Error Reading File System Data from Disc, No Further Information Available | p. 108 |
| Error Reading Sector nnnnn in Track nn, Analysis of Track Skipped | p. 108 |
| Error Returned Obtaining ISRC Code, Sense = ss ss | p. 108 |
| File ssssss is Linked to Track nnn, Session nn | p. 109 |
| HFS Volume Name ssssss | p. 109 |
| Image File in type Format: ssssss | p. 109 |
| Invalid Boot Catalog Found, Key Values = 0xnn 0xnn | p. 109 |
| Lead-out Track Starts at Sector nnnnn | p. 109 |
| Little-endian Block Size (nnnn) Not Equal to Big-endian Block Size (nnnn) | p. 109 |
| Little-endian Volume Size (nnnnn) Not Equal to Big-endian Volume Size (nnnnn) | p. 110 |
| Media Catalog Number for this Disc is ssssss | p. 110 |
| Minimum Recording Speed = nnX, Maximum Recording Speed = nnX | p. 110 |
| Mismatched File Counts Between this File System and the ssssss File System | p. 111 |
| Next Writable Location on Disc is nnnnn | p. 111 |
| No Directory Was Found for This File System | p. 111 |
| No ISRC/RID Code Present for This Track | p. 111 |
| No Manufacturer Information was Returned for This Disc | p. 111 |
| None of the Files in This Session Are Linked to Prior Sessions | p. 112 |
| Note: Directory Depth of nn May Cause Problems on Some MSCDEX Versions | p. 112 |
| Note: Directory Depth of nn Violates ISO-9660 Limit of Eight | p. 112 |
| One or More Files are Using Characters Which MS-DOS Cannot Access | p. 112 |
| One or More Files Do Not Have a Trailing Version Identifier (";1") | p. 113 |
| Partition Name: ssssss | p. 113 |
| Publisher Identification | p. 113 |
| Rock Ridge Extension Information is Present | p. 113 |
| Table of Contents | p. 113 |
| The "." Directory Entry is Missing From One or More Directories | p. 114 |
| The ".." Directory Entry is Missing From One or More Directories | p. 114 |
| The tttttt Code for This Track is cccccc | p. 114 |
| The Block Size is nnnn, Not 2048 as Would Be Expected | p. 114 |
| The Directory in This File System Qualifies as Using the setname Character Set | p. 115 |
| The Disc Is Not Recorded in XA Mode, But This File System is Marked for XA Mode | p. 115 |
| The Disc Is Recorded in XA Mode, But This File System Is Not Marked for XA Mode | p. 115 |
| The File "ssssss" Appears in the Directory But is Not Present | p. 116 |
| The Files ssssss and ssssss Overlap and One or Both are Destroyed | p. 116 |
| The Last Track in the Table of Contents is Not the Lead-out | p. 116 |
| The Mastering Program for this Disc Did Not Place Version Numbers (";1") After the Filenames | p. 117 |
| The Post-gap for This Disc is Either Missing or Invalid, nnn Trailing Sectors Found | p. 117 |
| The System Identifier in the ISO-9660 Volume Descriptor Contains Other Than "a" Characters | p. 117 |
| The Volume Identifier in the ISO-9660 Volume Descriptor Contains Other Than "d" Characters | p. 117 |
| The Volume Identifier is Blank. This May Cause Problems | p. 118 |
| There Appear To Be Additional Boot Definitions Present | p. 118 |
| There are nnn Files in the Directory Which Are Not Recorded in This File System | p. 118 |
| There are nnn Accessible Files and nnn Directories Contained in This File System | p. 119 |
| There are nnn Directories in This File System | p. 119 |
| There are nnn Files in This File System | p. 119 |
| There are nnn Files Linked from Session nn | p. 119 |
| There are nnn Files That Could Not Be Connected to a Filename | p. 119 |
| There are nnnn Free Sectors in This Track | p. 119 |
| There is a Total of nnn File Systems on Disc | p. 120 |
| This Disc Appears to be "Open" and Can Have Data Added to It. The Pointer is nnnnn | p. 120 |
| This Disc Has nn Layers | p. 120 |
| This Disc Is Still "Open" and Can Have Data Added To It | p. 120 |
| This File System Contains Compressed Data | p. 120 |
| This File System Was Written by ssssss | p. 121 |
| This File System Was Written by Packet-writing Software | p. 121 |
| This Track Contains Audio with Pre-emphasis | p. 121 |
| This Track Contains Audio without Pre-emphasis | p. 121 |
| This Track Contains Data and Contains ssssss File System(s) | p. 121 |
| This Track Contains Data from the File System in the Prior Track | p. 122 |
| This Track Has Been Recorded in XA Mode | p. 122 |
| This Track is Marked as Being Blank | p. 122 |
| Track nn Has Been Added to Represent an Open Session | p. 122 |
| Track nn is an Audio Track | p. 123 |
| Track nn Occupies nnn sectors (nn Min, nn Sec, nn Frames) | p. 123 |
| Track Contains MCN of nnnnnn | p. 123 |
| Track Image Written with nnnn Byte Sectors | p. 123 |
| Track Was Written with Fixed-length Packets nnnn Bytes in Length | p. 123 |
| Track Was Written with Variable-length Packets | p. 123 |
| UDF Examination Error: ssssss | p. 124 |
| UDF Partition Exceeds Size of | |
| Track According To Disc Information | p. 124 |
| Volume Create Date date | p. 124 |
| Volume Size Appears Suspicious; Header Says nnnnn While Track is nnnnn Sectors | p. 124 |
| Warning: One or More Checksum Errors were Detected in the UDF Structures | p. 124 |
| Warning: Root Directory Length is Specified as Zero | p. 125 |
| Warning: This Disc is Marked as Having a Sparable Partition, But No Sparing Information Table is Present | p. 125 |
| Warning: Virtual Allocation Table Missing | p. 125 |
| Warning: VAT Not Found in Conventional Place | p. 125 |
| Whole Disc MD5 Hash Value xxxxxxxxxxxxxxxxx | p. 126 |
| The Hardware Information Display | p. 126 |
| Device Name | p. 126 |
| Revision | p. 126 |
| Date of Revision | p. 127 |
| Read CDDA Command | p. 127 |
| "RAW read" Command | p. 127 |
| Track Information Command | p. 127 |
| Using 10- Byte Commands | p. 127 |
| Readability Test Reason Code | p. 128 |
| Loading Mechanism | p. 128 |
| Bar Code Reading Supported | p. 128 |
| UPC Code is Read | p. 128 |
| ISRC Code is Read | p. 128 |
| C2 Error Pointers | p. 128 |
| Maximum Reading Speed | p. 129 |
| Multi-session Capable | p. 129 |
| Mode 2 Form 1 Supported | p. 129 |
| Mode 2 Form 2 Supported | p. 129 |
| Digital Output on Port 1 | p. 129 |
| Digital Output on Port 2 | p. 129 |
| Audio Play Supported | p. 130 |
| Reading CDDA Supported | p. 130 |
| CD-Text/CD+G Supported | p. 130 |
| CD-Text/CD+G Decoded | p. 130 |
| Accurate CDDA Positioning | p. 130 |
| Transfer Block Supported | p. 131 |
| Inactivity Spin-down | p. 131 |
| Device Capabilities | p. 131 |
| Device Buffer Size (in K) | p. 131 |
| Drive Serial Number | p. 131 |
| The Volume Information Display | p. 131 |
| ISO-9660 Volume Information | p. 132 |
| Volume ID | p. 132 |
| System ID | p. 132 |
| Volume Size | p. 133 |
| System Use | p. 133 |
| Volume Set Size | p. 133 |
| Volume in Set | p. 133 |
| Block Size (Bytes) | p. 133 |
| Path Table Size (Bytes) | p. 134 |
| Path Table (L) | p. 134 |
| Optional Path Table (L) | p. 135 |
| Path Table (M) | p. 135 |
| Optional Path Table (M) | p. 135 |
| Root Directory Sector | p. 135 |
| Root Directory Timestamp | p. 135 |
| Volume Set | p. 135 |
| Publisher | p. 136 |
| Data Preparer | p. 136 |
| Application | p. 136 |
| Copyright File | p. 136 |
| Abstract File | p. 137 |
| Bibliography File | p. 137 |
| Volume Created | p. 137 |
| Volume Modified | p. 138 |
| Volume Expires | p. 138 |
| Volume Effective | p. 138 |
| Volume Size | p. 138 |
| Volume Set Size | p. 138 |
| Volume in Set | p. 138 |
| Block Size (Bytes) | p. 139 |
| Path Table Size (Bytes) | p. 139 |
| Root Directory Sector | p. 139 |
| Joliet Volume Information | p. 139 |
| Volume ID | p. 139 |
| System ID | p. 139 |
| Volume Size | p. 140 |
| System Use | p. 140 |
| Volume Set Size | p. 140 |
| Volume in Set | p. 141 |
| Block Size (Bytes) | p. 141 |
| Path Table Size (Bytes) | p. 141 |
| Path Table (L) | p. 141 |
| Optional Path Table (L) | p. 142 |
| Path Table (M) | p. 142 |
| Optional Path Table (M) | p. 142 |
| Root Directory Sector | p. 142 |
| Root Directory Timestamp | p. 143 |
| Volume Set | p. 143 |
| Publisher | p. 143 |
| Data Preparer | p. 143 |
| Application | p. 144 |
| Copyright File | p. 144 |
| Abstract File | p. 144 |
| Bibliography File | p. 145 |
| Volume Created | p. 145 |
| Volume Modified | p. 145 |
| Volume Expires | p. 146 |
| Volume Effective | p. 146 |
| Volume Size | p. 146 |
| Volume Set Size | p. 146 |
| Volume in Set | p. 146 |
| Block Size (Bytes) | p. 146 |
| Path Table Size (Bytes) | p. 146 |
| Root Directory Sector | p. 147 |
| HFS and HFS+ Volume Information | p. 147 |
| Volume ID | p. 147 |
| Files | p. 147 |
| Directories | p. 147 |
| Allocation Size (Bytes) | p. 147 |
| Allocation Blocks | p. 147 |
| Free Blocks | p. 148 |
| Volume Created | p. 148 |
| Volume Modified | p. 148 |
| HSG Volume Information | p. 148 |
| UDF Volume Information | p. 148 |
| Volume Descriptor Sequence | p. 148 |
| Volume ID | p. 148 |
| Interchange Level | p. 149 |
| Volume Set Name | p. 149 |
| Implementation Identifier | p. 149 |
| Application | p. 149 |
| Recording Time | p. 149 |
| Disc Reports | p. 149 |
| Disc Contents by Folder | p. 151 |
| Disc Contents by Name | p. 152 |
| Disc Contents by Extension | p. 153 |
| Files with MD5 Hash Value | p. 154 |
| CSV Format Export | p. 155 |
| Image Reports | p. 156 |
| Using CD/DVD Inspector | p. 159 |
| Examining a Disc-A Step-by-step Guide | p. 160 |
| Starting CD/DVD Inspector | p. 160 |
| Initial Observations | p. 161 |
| Analysis Tool | p. 161 |
| Disc Map | p. 162 |
| Quick Image Examination | p. 162 |
| Scan Files for Keywords | p. 163 |
| Other Examination Tasks | p. 163 |
| Create an ISO Image File | p. 163 |
| Create an InfinaDyne Image File | p. 164 |
| Determining the Writing Application | p. 165 |
| Date Correspondence | p. 165 |
| Missing Files | p. 166 |
| Multi-Session Hiding | p. 167 |
| Advanced Tasks with CD/DVD Inspector | p. 169 |
| Using Hash Matching and MD5 Hashes | p. 170 |
| Space Utilization Analysis | p. 171 |
| ISO-9660 Directory Analysis | p. 176 |
| Unknown Data Track Issues | p. 179 |
| Reporting Your Findings | p. 181 |
| Full List of All Files on the Media | p. 182 |
| Image Report(s) | p. 183 |
| Analysis Report | p. 183 |
| Scan Files Results | p. 184 |
| Raw Search Results | p. 184 |
| Things to Keep In Mind | p. 185 |
| Disc Swap Drive Modification | p. 187 |
| Downloading Additional Materials | p. 195 |
| Glossary | p. 197 |
| Index | p. 283 |
| Table of Contents provided by Ingram. All Rights Reserved. |
ISBN: 9781597491280
ISBN-10: 1597491284
Published: 26th February 2007
Format: Paperback
Language: English
Number of Pages: 320
Audience: Professional and Scholarly
Publisher: SYNGRESS
Country of Publication: US
Dimensions (cm): 22.23 x 17.15 x 2.54
Weight (kg): 0.42
Shipping
| Standard Shipping | Express Shipping | |
|---|---|---|
| Metro postcodes: | $9.99 | $14.95 |
| Regional postcodes: | $9.99 | $14.95 |
| Rural postcodes: | $9.99 | $14.95 |
Orders over $79.00 qualify for free shipping.
How to return your order
At Booktopia, we offer hassle-free returns in accordance with our returns policy. If you wish to return an item, please get in touch with Booktopia Customer Care.
Additional postage charges may be applicable.
Defective items
If there is a problem with any of the items received for your order then the Booktopia Customer Care team is ready to assist you.
For more info please visit our Help Centre.
You Can Find This Book In

Astronomy for Curious Kids
An illustrated introduction to the solar system, our galaxy, space travel-and more!
Hardcover
RRP $32.99
$28.75
OFF

Biofuel Perspectives
Methanol and Ethanol in Combustion Engines from Production to Practical Application
Paperback
RRP $363.95
$322.75
OFF
This product is categorised by
- Non-FictionComputing & I.T.Graphical & Digital Media Applications
- Non-FictionEngineering & TechnologyTechnology in General
- Non-FictionSocial Services & WelfareCrime & CriminologyCriminal Investigation & DetectionForensic Science
- Non-FictionComputing & I.T.Computer HardwareStorage Media & Peripherals
- Non-FictionComputing & I.T.Computer SecurityData Encryption
- Non-FictionComputing & I.T.Computer Science






















