CD WHEN WAS IT WRITTEN?

Working on a forensic job.  Need to determine WHEN a CD was copied with a disk copier similar to Easy CD creator.  The standard tools that read ATIP info which unfortunately gives the date the CD was initially mastered.  We are dealing with CD's that are copied, according to a quick experiment with a manufactured disk, the Content Date reported by Nero Info Tool is the same value on a copy and original. Where to look for hidden information about when the copy was done?
LVL 18
carl_legereAsked:
Who is Participating?
 
Gary CaseConnect With a Mentor RetiredCommented:
Do you know the specific copy utility that was used?   As knoxzoo noted, the goal of a good copier is to make an EXACT copy -- so there may very well be no indication of the date it was made.   That's the reason Microsoft uses disk holograms to identify legitimate copies of their software -- they tried various schemes to embed info on the CD's, but the duplication industry could duplicate any of them.   So they resorted to a physical modification of the CD (holograms) that is very difficult to duplicate; and to the activation process so the copies couldn't be used.

IF by chance the original disc used a copy protection mechanism, then the copy will most likely be identifiable as to what technique was used to bypass the copy protection;  but from your description this does not appear to be the case.   So I suspect you simply won't be able to identify the date the copy was made.  Even very detailed forensic analysis software (e.g. Infinadyne's CD/DVD Inspector) is not likely to be able to help -- they are focused on recovering WHAT is on the disc, and showing everything that was ever recordered on it; but in a disc copy case (i.e. not a FILE copy case) the only thing ever recorded on the blank is most likely simpy an exact copy of the original CD.


0
 
knoxzooCommented:
The whole idea behind a copier utility is to make an exact duplicate of the original.  If the date info changed anywhere on the disk, there would be no need for all the various copyguard schemes.  It would be a simple matter of telling the program to look for a specific date on a specific area of the disk.

0
 
scrathcyboyCommented:
Use IsoBuster Pro 1.8, load the CD/DVD, go to Sector view, jump to sector 16 and following -- there you will find all of the forensic information you can get from the burning event itself.  Most is encoded, and sorry, I cannot say what it all means, that would be a little too much for a public forum, but you can figure out a lot of it yourself.  

Short of that, you would have to do a surface analysis of the disc and this would not be conclusive.  Remember, other than the burning event information Ive shown you how to find, above, a true clone is a true clone, there is not ONE byte difference at the sector level across the entire disc.
0
Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
Gary CaseRetiredCommented:
The Primary Volume Descriptor recorded starting at Sector 16 does indeed contain the recording date and time ==> but I'm not at all sure this is replaced when duplicating a CD.  It won't hurt to check it, however.   The Recording Date and Time is in byte positions 19 through 25, and is structured as shown in the detailed layout of the Primary Volume Descriptor shown here:
http://www.cdroller.com/htm/technol.html

Let us know if that field is indeed updated when a copy is made.


0
 
Gary CaseRetiredCommented:
carl_legere => Just curious if you were able to determine the date from the primary volume descriptor ...

0
 
scrathcyboyCommented:
I think my answer answers this Q as best as can be done
0
 
Gary CaseRetiredCommented:
I don't believe IsoBuster shows the Primary Volume Descriptor info, which is what is required to determine the actual date information --> it's also not clear that the PVD is modified during a "copy" operation.   But if it is, it requires more detailed tools;  IsoBuster is more of an "extract the data" program than a "show the raw sectors" program.
0
 
carl_legereAuthor Commented:
.. was not able to solve the problem, which is logical considering the details.
0
 
Gary CaseRetiredCommented:
I'm not surprised ... as I noted earlier, it's not clear the PVD is modified during a copy;  and if not then there's no way to determine the actual date it was written (only the date the original was written).

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.