File000123

Module X – CD-DVD Forensics

EC-CouncilCopyright © by EC-Council

All Rights Reserved. Reproduction is Strictly Prohibited

Module Objective

• Compact Disc• DVD• How Criminals use CD/DVD for Crime• CD Forensics• CD/DVD Imaging Tool• CD/DVD Data Recovery Tools• Acodisc CD & DVD Data Recovery Services

This module will familiarize you with:



Module Flow

Compact Disc CD/DVD Imaging Tool

CD Forensics

CD/DVD Data Recovery ToolsDVD

Acodisc CD & DVD Data Recovery Services

How Criminal usesCD/DVD for Crime



Compact Disc

A Compact Disc (CD) is an optical disc to store digital data

It is made up of pure polycarbonate plastic disc

In a CD, data is stored as a series of tiny indentations (pits), encoded in a tightly packed spiral track of pits molded into the top of the polycarbonate layer

Infrared 780 nm laser is used to write data on a CD



Types of CDs

• Each CD-ROM sector is 2352 bytes, and contains 2048 bytes of PC Data, 2336 bytes of PSX/VCD Data, or 2352 bytes of AUDIO

• A standard 120 mm CD-ROM holds 650 or 700 MB of data

Compact Disc Read-Only Memory (CD-ROM)

• CD-R is a compact disc format that allows only one time recording on the disc

CD-R

• CD-RW (for compact disc, rewriteable) is a compact disc (CD) format that allows repeated recording on a disc

• CD-RW discs usually hold 74 minutes (650 MB) of data, although some can hold up to 80 minutes (700 MB) and can be rewritten as many as 1000 times

CD-R/W



Digital Versatile Disc (DVD)

DVD is an optical disc technology with a 4.7 gigabyte storage capacity on a single-sided, one-layered disc

A double-sided, two-layered DVD will hold up to 17 gigabytes of video, audio, or other information

DVD has enough space to store a full-length, MPEG-2-encoded movie, as well as other information

Like a CD, the data on a DVD is encoded in the form of small pits and bumps on the track of the disc

DVDs can store more data than CDs because of:

• Higher-density data storage• Less overhead, more area• Multi-layer storage



DVD-R and DVD+R

• DVD-R disc formats can only be written to once, and then it is only readable

• DVD-R is a DVD recordable format having 4.7 GB storage capacity• It can only be written to in one layer on the disc’s surface• DVD-R standard was developed by Pioneer, and is used primarily by

Apple and Pioneer

DVD-R:

• A DVD+R is a writable optical disc with 4.7 GB of storage capacity• DVD+R discs can be written only once • These discs can be written to in multiple layers, giving slightly better

and more disc storage • DVD+R format is supported by Philips, Dell, Sony, HP, and Microsoft

DVD+R:



DVD-RW and DVD+RW

• A DVD-RW is a rewritable optical disc with storage capacity equal to a DVD-R, typically 4.7 GB

• Not all DVD players can read DVD-RWs• The recording in a DVD-RW needs an initialization and termination

process• To start recording in a DVD-RW, it is necessary to format the disc entirely

DVD-RW:

• A DVD+RW is a rewritable optical disc with storage capacity equal to a DVD+R, typically 4.7 GB

• DVD+R discs are compatible with most DVD players • In the recording of a DVD+RW, neither the initialization process

nor the finalization is necessary

DVD+RW:

Both discs are used for large data storage such as backups



DVD+R DL, DVD-R DL, DVD-RAM

• DVD+R DL or DVD+R9 is a Dual Layer writeable DVD+R• DVD-9:

• The dual layered discs can hold 7.95 GB data

• DVD-18:• The dual layered double sides discs can hold 15.9 GB data

DVD+R DL:

• DVD-R DL or DVD-R9 is a Dual Layer writeable DVD-R• The dual layered discs can hold 7.95 computer GB called DVD-9 and

dual layered double sides 15.9 called dvd-18

DVD-R DL:

• DVD-RAM (DVD-Random Access Memory) is a rewritable form that can be rewritten over 100,000 times

• It has the best recording features but it is not compatible with most DVD-ROM drives and DVD-Video players

• It is usually used in some DVD Recorders

DVD-RAM:



Blu-Ray

Blu-ray is the next-generation digital video disc patented by SONY

With their high storage capacity, Blu-ray discs can hold and play back large quantities of high-definition video and audio, photos, and other digital content

Blu-Ray discs use 405 nanometer blue-violet lasers

A single-layer Blu-ray disc can hold up to 27 GB of data and a double-layer Blu-ray disc can store up to 50 GB of data



Blu-Ray (cont’d)

• Records high-definition television (HDTV) without any loss in quality

• Instantly skips to any spot on the disc• Records one program while watching

another on the disc • Creates playlists• Edits or reorders programs recorded on the

disc• Automatically searches for an empty space

on the disc to avoid recording over a program

• Accesses the web to download subtitles and other extra features

Advantages:



SID Code

SID code is a four character code that identifies the source of music and manufacturer

It can be applied to all CD and DVD, including all recordable forms of CD and DVD

It works as an anti-piracy tool



How Criminals use CD/DVD for Crime

To store illegal material

To store the pornographic images and videos

To keep the critical information about the organization

Software piracy

To keep the contact details of other criminals



Pre-Requisite for CD/DVD Forensics

To conduct an examination of the digital evidence on CD or DVD media, the following hardware, software, and workstation are mandatory

Forensic Hardware:

• CD-RW• DVD writer that can read both DVD+ and DVD– media

Forensic Software:

• AccessData Forensic Tool Kit (FTK)• EnCase• ILook Investigator

Forensic Workstation:

• Proper Basic Input Output System (BIOS) configuration• No conflicting software• No contaminating data• The time and date synchronized properly• Properly licensed software



Steps for CD Forensics

Data Analysis

Recover data from damaged or corrupted CDs/DVDs

Create image of CD/DVD

Preserve the evidence

Document the scene

Collect the CD/DVD evidence



Collect the CD/DVD evidence

Collect the CD/DVD material available at the incident

Collect non-electronic evidence such as written passwords, handwritten notes, computer printouts, and so on

Keep the evidence at secure place and protect them from damage



Precautions while Collecting the Evidence

Hold CD/DVD only by outer edges and center hole to avoid scratches

Use water-based markers for writing on discs

Stack the discs on spindles

Take special precautions with discs that are cracked

Rinse discs with distilled water to remove surface dirt, possible drug contamination, grease, and/or oils

Do not use any type of cleaner based on organic or petroleum solvents



Document the Scene

Document the state of the device during seizure

Photograph the evidence

Maintain chain of custody of documents, photographs, and evidence

Check the discs for evidence such as fingerprints and surface markings on the disc

Photograph the surface of a disc

Photograph the label side of a disc, markings that are placed by the person writing the disc



Preserve the Evidence

Keep the discs away from magnetic fields

Keep the discs away from sunlight

Secure the discs from mechanical or electrical shock

Protect the evidence from unauthorized users



Create Image of CD/DVD

Create the image of data in the discs in order to prevent damage to the original data

Use different image making tools such as UltraISO and Nero

Use hashing techniques to ensure that binary image is an exact bit-for-bit copy of the original



Recover Data from Damaged or Corrupted CDs/DVDs

Recover data from damaged or corrupted CDs/DVDs

Recover data from images of the discs in order to prevent damage to the original data

Use different data recovery tools such as Multi Data Rescue and CDRoller



Data Analysis

Recover the hidden information

Use the steganalysis tools such as Stegdetect to extract the hidden information

Use cryptanalysis tools such as Crank and Jipher to reveal the encrypted information

Use the password cracking tools such as Cain, Abel, and Hydra to ensure if the information is password protected

If the data is in audio or video format, use different audio/video players

Check for the creation and modification time of the file and the author of the files

Find out:

• What exactly happened?• When event occurred?• Who were involved?• How it occurred?



Identify Pirated CD/DVDs

• No record company logos• SID Code obliterated or no SID Codes• Poor-quality inlay and graphics, often 2 color print only that can

be peeled off• Poor paper quality • Promo versions• Incomplete, incorrect, or no licensing or trademark details• Copyright holder not mentioned, incorrect, or fictitious• Discrepancies between disc and packaging• Incorrect spellings• Artist name or album title is incomplete or cropped off the disc

You can identify pirated CD/DVDs by checking the following points:



Identify Pirated CD/DVDs (cont’d)

More than one artist’s full album on a disc

DVD contains more than one film on a disc of different production companies

Low cost

No plastic ‘jewel’ case

CDs, plastic cases, and inlay cards packed separately

Discrepancies on inlay card relating to information from other films

Disc is a CD-R/DVD-R

“All” zone region code

Release date of title - Film is currently in cinemas

Zone 1 logos and Asian or Cyrillic characters



Original and Pirated CD/DVDs

Pirated CDOriginal CD



CD/DVD Imaging Tools

UltraISO

MagicISO

Cdmage

Alcohol

Nero



UltraISOhttp://www.ezbsystems.com/ultraiso/

• Can create CD/DVD image from CD/DVD-ROM and maintain bootable information

• Build files/folders to one ISO File • Edit and convert ISO file in many formats • Make bootable CD/DVDs • Create/edit audio CD image

Features:

UltraISO is an ISO CD/DVD image file creating/editing/converting tool, and a bootable CD/DVD maker

It can directly edit the CD/DVD image file and extract files and folders from it, as well as directly make ISO files from your CD/DVD-ROM or hard disc



UltraISO: Screenshot



MagicISOhttp://www.magiciso.com/

MagicISO is a CD/DVD image file creating/editing/extracting tool

It helps to make CD/DVD image from DVD/CD-ROM to hard disc in order to back up CD/DVD or use it with virtual CD or virtual machine

• Support all known CD image type• Directly edit CD/DVD image file• Make bootable CD/DVD

Features:



MagicISO: Screenshot



Cdmagehttp://cdmage.orconhosting.net.nz/

• Extract and convert tracks into any compatible supported format

• Extract files from data tracks• Compare files with files burned on the CD or with files on the

HD • Locate the content of corrupted sectors• Play audio and CD+G tracks direct from all image files without

extracting while scanning, repairing, and locating errors

Features:

Cdmage supports multisession images



Cdmage: Screenshot



Alcoholhttp://www.alcohol-soft.com/

Alcohol is a Windows CD and DVD burning software that creates backups of DVDs and CDs



Nerohttp://www.nero.com/

• Supports Blu-ray Disc and HD DVD burning • Supports SecurDisc data protection • Organizes and manages all your multimedia files, as well

as creates and edits new digital content

Features:

Nero is the CD/DVD burner software that creates exact copy of the disc information



Nero: Screenshot



CD/DVD Data Recovery Tools

CDRoller

Badcopy Pro

Multi Data Rescue

InDisc Recovery

Stellar Phoenix -CD Data Recovery Software

CD Recovery Toolbox

IsoBuster

CD/DVD Inspector

Acodisc CD & DVD Data Recovery Services



CDRollerhttp://www.cdroller.com/

CDRoller is the CD and DVD data recovery tool

It acts as a fault-tolerant data CD contents reader with capabilities to search for lost data tracks

It offers extended UDF reading features with the capability to search and recover lost files

The built-in CD Data Rescue tool allows you to recover the files and folders from the damaged discs



CDRoller: Screenshot



Badcopy Prohttp://www.jufsoft.com/badcopy/

BadCopy Pro is a tool that is valuable to forensic investigators for removable storage mediums

It does not write data to the original disc but to a location specified by the user

It recovers files from floppy discs, CD-ROMs, CD-R/Ws, digital media, zip discs, and other storage media

It can recover corrupted or lost data



Badcopy Pro: Screenshot



Multi Data Rescue http://www.naltech.com/

Multi Data Rescue is a windows based application designed specifically to recover files from damaged, scratched or defective discs, and digital media

It supports data recovery from damaged CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-R, DVD-RW, DVD+R, DVD+RW, DVD-RAM, HD-DVD-R, HD-DVD-RW, BD-R, and BD-RE discs

It supports digital media recovery, recovers lost or deleted files, photos and videos from removable discs, USB discs, digital cameras and phones, memory cards, etc.

It recovers unreadable and deleted files from discs recorded by common disc writing software in ISO and UDF formats, including Roxio Easy Creator and Ahead Nero



Multi Data Rescue: Screenshot



InDisc Recoveryhttp://www.octanesoft.com/

• Identifies and recovers deleted files from RW discs that have been deleted through Quick Format mode

• Supports CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-R, DVD-RW, DVD+R, DVD+RW, and DVD-RAM

• Easy-to-use interface, no special skill required, and supports multi-session media

• Ability to preview Image, Ascii, and Hex data

Features:

InDisc Recovery is CD or DVD data recovery tool

It is specifically designed to recover any type of deleted, lost, or unreadable files and folders from damaged, scratched, or defective CDs and DVDs



InDisc Recovery: Screenshot



Stellar Phoenix -CD Data Recovery Softwarehttp://www.stellarinfo.com/

• File recovery from damaged CDROM, CD-R, and CD-RW• Data recovery when TOC (Table of Contents) is bad or damaged• Provides data recovery even after primary volume descriptor and secondary volume

descriptor are corrupt or physically damaged• Data recovery when data cannot be accessed and disc indicates that it is full• Provides file recovery when disc has physical damages : scratch, bubbles, cracks, and

warping• Provides CD data recovery when computer freezes while trying to read the disc• Provides CD file recovery when disc has data but appears blank or is displayed as audio

disc

Features:

Stellar Phoenix - CD Data Recovery Software recovers data from damaged or defective CD-ROM, CD-R, and CD-RW

It recovers data and file lost due to unreadable, scratched, corrupt, or defective CD media



Stellar Phoenix: Screenshot



CD Recovery Toolboxhttp://www.oemailrecovery.com

CD Recovery Toolbox recovers damaged files from different disc types

It recovers files from damaged or corrupted CD/DVD/HD DVD/Blu-Ray discs

It scans any CD and DVD discs and finds files and folders located in the toolbox

• Recovers information from any CD and DVD discs• Recovers files larger than 4 Gb• Detects possible lack of free space on the hard disc for storing the

recovered files

Features:



CD Recovery Toolbox: Screenshot



Tool: IsoBusterwww.smart-projects.net

IsoBuster is a CD/DVD and (Disc) Image File data recovery tool

It rescues lost files from a bad or trashed CD or DVD or a Blu Ray disc

It supports all CD/DVD File-Systems and enormous range of image files

Features:

• Recovers data from all possible CD and DVD formats• Supports for direct CD compressed files

IsoBuster performs two major functions:

• CD (DVD) backup• Recovery



IsoBuster: Screenshot



CD/DVD Inspectorhttp://www.infinadyne.com/cddvd_inspector.html

CD/DVD Inspector reads all major CD and DVD filesystem formats including ISO-9660, Joliet, UDF, HFS, and HFS+

Features:

• Complete CD imaging• Supports creation of ZIP images from media• Supports DVD Media Recovery• File scanning• Built-in Image Viewer• Low-level sector examination and scanning



Acodisc CD & DVD Data Recovery Serviceshttp://www.acodisc.com/

Acodisc CD & DVD Data Recovery services help in data recovery and repair of inaccessible, unreadable, or deleted data, video, files, pictures, and documents

It recovers data from optical storage media such as:

• CD-ROM, CD-R, and CD-RW• DVD-RAM, DVD-R/W, DVD+R/W, and 3-inch Mini CD-R• Mini DVD-R/RAM Discs, Home Audio Recording CDs, Compact Flash-

CF), Smart Media (SSFDC), Sony memory sticks, and PCMCIA ATA Cards



Acodisc CD & DVD Data Recovery Services (cont’d)

• Unreadable CD-ROM, CD-R, CD-RW, DVD-RAM, DVD-R/W, or 3-inch Mini CD-R

• Data cannot be accessed but the disc indicates that it is full• Accidental quick erased, quick formatted, or file deletion• Files and/or directory can be seen but files cannot be moved or used on the

media• Error dialog box says "Files do not exist"• Corrupted or missing TOC (Table of Contents) or directory information• Damaged or crossed sessions, caused by operator error• Problems with your operating system or shuts down during write, causing CD

errors• Physical damages: bubbles, cracks, scratches, warping• When the media is put in the drive, the drive makes a loud whirring sound• Computer freezes or locks up, while trying to read the media• CD that had data on it, now incorrectly appears to be a blank or an audio CD• Failed CDs from Home Audio Recorders

Acodisc services solve the problems such as:



Summary

A Compact Disc (CD) is an optical disc to store digital data

DVD has enough space to store a full-length, MPEG-2-encoded movie, as well as other information

HD-DVD is a next-generation optical disc format designed for high-density storage of high-definition video and data

An investigator may get some evidence such as fingerprints and surface markings on the disc

IsoBuster is a CD/DVD and (Disc) Image File data recovery tool

File000123

Technology

Transcript of File000123