File000123

EC-Council
Copyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
Module Objective
• Compact Disc
• DVD
• How Criminals use CD/DVD for Crime
• CD Forensics
• CD/DVD Imaging Tool
• CD/DVD Data Recovery Tools
• Acodisc CD & DVD Data Recovery Services
This module will familiarize you with:

EC-Council
Module Flow
Compact Disc CD/DVD Imaging Tool
CD Forensics
CD/DVD Data
Recovery ToolsDVD
Acodisc CD & DVD
Data Recovery Services
How Criminal uses
CD/DVD for Crime

EC-Council
Compact Disc
A Compact Disc (CD) is an optical disc to store digital data
It is made up of pure polycarbonate plastic disc
In a CD, data is stored as a series of tiny indentations (pits),
encoded in a tightly packed spiral track of pits molded into
the top of the polycarbonate layer
Infrared 780 nm laser is used to write data on a CD

EC-Council
Types of CDs
• Each CD-ROM sector is 2352 bytes, and contains 2048 bytes of PC Data,
2336 bytes of PSX/VCD Data, or 2352 bytes of AUDIO
• A standard 120 mm CD-ROM holds 650 or 700 MB of data
Compact Disc Read-Only Memory (CD-ROM)
• CD-R is a compact disc format that allows only one time recording on the
disc
CD-R
• CD-RW (for compact disc, rewriteable) is a compact disc (CD) format that
allows repeated recording on a disc
• CD-RW discs usually hold 74 minutes (650 MB) of data, although some can
hold up to 80 minutes (700 MB) and can be rewritten as many as 1000
times
CD-R/W

EC-Council
Digital Versatile Disc (DVD)
DVD is an optical disc technology with a 4.7 gigabyte storage capacity on a single-sided, one-
layered disc
A double-sided, two-layered DVD will hold up to 17 gigabytes of video, audio, or other
information
DVD has enough space to store a full-length, MPEG-2-encoded movie, as well as other
information
Like a CD, the data on a DVD is encoded in the form of small pits and bumps on the track of
the disc
DVDs can store more data than CDs because of:
• Higher-density data storage
• Less overhead, more area
• Multi-layer storage

EC-Council
DVD-R and DVD+R
• DVD-R disc formats can only be written to once, and then it is only
readable
• DVD-R is a DVD recordable format having 4.7 GB storage capacity
• It can only be written to in one layer on the disc’s surface
• DVD-R standard was developed by Pioneer, and is used primarily by
Apple and Pioneer
DVD-R:
• A DVD+R is a writable optical disc with 4.7 GB of storage capacity
• DVD+R discs can be written only once
• These discs can be written to in multiple layers, giving slightly better
and more disc storage
• DVD+R format is supported by Philips, Dell, Sony, HP, and Microsoft
DVD+R:

EC-Council
DVD-RW and DVD+RW
• A DVD-RW is a rewritable optical disc with storage capacity equal to a
DVD-R, typically 4.7 GB
• Not all DVD players can read DVD-RWs
• The recording in a DVD-RW needs an initialization and termination
process
• To start recording in a DVD-RW, it is necessary to format the disc entirely
DVD-RW:
• A DVD+RW is a rewritable optical disc with storage capacity
equal to a DVD+R, typically 4.7 GB
• DVD+R discs are compatible with most DVD players
• In the recording of a DVD+RW, neither the initialization process
nor the finalization is necessary
DVD+RW:
Both discs are used for large data storage such as backups

EC-Council
DVD+R DL, DVD-R DL, DVD-
RAM
• DVD+R DL or DVD+R9 is a Dual Layer writeable DVD+R
• DVD-9:
• The dual layered discs can hold 7.95 GB data
• DVD-18:
• The dual layered double sides discs can hold 15.9 GB data
DVD+R DL:
• DVD-R DL or DVD-R9 is a Dual Layer writeable DVD-R
• The dual layered discs can hold 7.95 computer GB called DVD-9 and
dual layered double sides 15.9 called dvd-18
DVD-R DL:
• DVD-RAM (DVD-Random Access Memory) is a rewritable form that
can be rewritten over 100,000 times
• It has the best recording features but it is not compatible with most
DVD-ROM drives and DVD-Video players
• It is usually used in some DVD Recorders
DVD-RAM:

EC-Council
Blu-Ray
Blu-ray is the next-generation digital video disc patented by SONY
With their high storage capacity, Blu-ray discs can hold and play back large
quantities of high-definition video and audio, photos, and other digital content
Blu-Ray discs use 405 nanometer blue-violet lasers
A single-layer Blu-ray disc can hold up to 27 GB of data and a double-layer Blu-ray
disc can store up to 50 GB of data

EC-Council
Blu-Ray (cont’d)
• Records high-definition television (HDTV)
without any loss in quality
• Instantly skips to any spot on the disc
• Records one program while watching
another on the disc
• Creates playlists
• Edits or reorders programs recorded on the
disc
• Automatically searches for an empty space
on the disc to avoid recording over a
program
• Accesses the web to download subtitles and
other extra features
Advantages:

EC-Council
SID Code
SID code is a four character code that identifies the source of music
and manufacturer
It can be applied to all CD and DVD, including all recordable forms of
CD and DVD
It works as an anti-piracy tool

EC-Council
How Criminals use CD/DVD for
Crime
To store illegal material
To store the pornographic images and videos
To keep the critical information about the organization
Software piracy
To keep the contact details of other criminals

EC-Council
Pre-Requisite for CD/DVD
Forensics
To conduct an examination of the digital evidence on CD or DVD media, the following
hardware, software, and workstation are mandatory
Forensic Hardware:
• CD-RW
• DVD writer that can read both DVD+ and DVD– media
Forensic Software:
• AccessData Forensic Tool Kit (FTK)
• EnCase
• ILook Investigator
Forensic Workstation:
• Proper Basic Input Output System (BIOS) configuration
• No conflicting software
• No contaminating data
• The time and date synchronized properly
• Properly licensed software

EC-Council
Steps for CD Forensics
Data Analysis
Recover data from damaged or corrupted CDs/DVDs
Create image of CD/DVD
Preserve the evidence
Document the scene
Collect the CD/DVD evidence

EC-Council
Collect the CD/DVD evidence
Collect the CD/DVD material available at the
incident
Collect non-electronic evidence such as written
passwords, handwritten notes, computer
printouts, and so on
Keep the evidence at secure place and protect
them from damage

EC-Council
Precautions while Collecting the
Evidence
Hold CD/DVD only by outer edges and center hole to avoid
scratches
Use water-based markers for writing on discs
Stack the discs on spindles
Take special precautions with discs that are cracked
Rinse discs with distilled water to remove surface dirt,
possible drug contamination, grease, and/or oils
Do not use any type of cleaner based on organic or
petroleum solvents

EC-Council
Document the Scene
Document the state of the device during seizure
Photograph the evidence
Maintain chain of custody of documents, photographs, and
evidence
Check the discs for evidence such as fingerprints and
surface markings on the disc
Photograph the surface of a disc
Photograph the label side of a disc, markings that are
placed by the person writing the disc

EC-Council
Preserve the Evidence
Keep the discs away from magnetic fields
Keep the discs away from sunlight
Secure the discs from mechanical or electrical shock
Protect the evidence from unauthorized users

EC-Council
Create Image of CD/DVD
Create the image of data in the discs in order to prevent damage to the
original data
Use different image making tools such as UltraISO and Nero
Use hashing techniques to ensure that binary image is an exact bit-for-
bit copy of the original

EC-Council
Recover Data from Damaged or
Corrupted CDs/DVDs
Recover data from damaged or corrupted CDs/DVDs
Recover data from images of the discs in order to prevent damage to
the original data
Use different data recovery tools such as Multi Data Rescue and
CDRoller

EC-Council
Data Analysis
Recover the hidden information
Use the steganalysis tools such as Stegdetect to extract the hidden information
Use cryptanalysis tools such as Crank and Jipher to reveal the encrypted information
Use the password cracking tools such as Cain, Abel, and Hydra to ensure if the
information is password protected
If the data is in audio or video format, use different audio/video players
Check for the creation and modification time of the file and the author of the files
Find out:
• What exactly happened?
• When event occurred?
• Who were involved?
• How it occurred?

EC-Council
Identify Pirated CD/DVDs
• No record company logos
• SID Code obliterated or no SID Codes
• Poor-quality inlay and graphics, often 2 color print only that can
be peeled off
• Poor paper quality
• Promo versions
• Incomplete, incorrect, or no licensing or trademark details
• Copyright holder not mentioned, incorrect, or fictitious
• Discrepancies between disc and packaging
• Incorrect spellings
• Artist name or album title is incomplete or cropped off the disc
You can identify pirated CD/DVDs by
checking the following points:

EC-Council
Identify Pirated CD/DVDs
(cont’d)
More than one artist’s full album on a disc
DVD contains more than one film on a disc of different production companies
Low cost
No plastic ‘jewel’ case
CDs, plastic cases, and inlay cards packed separately
Discrepancies on inlay card relating to information from other films
Disc is a CD-R/DVD-R
“All” zone region code
Release date of title - Film is currently in cinemas
Zone 1 logos and Asian or Cyrillic characters

EC-Council
Original and Pirated CD/DVDs
Pirated CDOriginal CD

EC-Council
CD/DVD Imaging Tools
UltraISO
MagicISO
Cdmage
Alcohol
Nero

EC-Council
UltraISO
http://www.ezbsystems.com/ultraiso/
• Can create CD/DVD image from CD/DVD-ROM and maintain
bootable information
• Build files/folders to one ISO File
• Edit and convert ISO file in many formats
• Make bootable CD/DVDs
• Create/edit audio CD image
Features:
UltraISO is an ISO CD/DVD image file creating/editing/converting tool, and a
bootable CD/DVD maker
It can directly edit the CD/DVD image file and extract files and folders from it,
as well as directly make ISO files from your CD/DVD-ROM or hard disc

EC-Council
UltraISO: Screenshot

EC-Council
MagicISO
http://www.magiciso.com/
MagicISO is a CD/DVD image file creating/editing/extracting tool
It helps to make CD/DVD image from DVD/CD-ROM to hard disc in
order to back up CD/DVD or use it with virtual CD or virtual machine
• Support all known CD image type
• Directly edit CD/DVD image file
• Make bootable CD/DVD
Features:

EC-Council
MagicISO: Screenshot

EC-Council
Cdmage
http://cdmage.orconhosting.net.nz/
• Extract and convert tracks into any compatible supported
format
• Extract files from data tracks
• Compare files with files burned on the CD or with files on the
HD
• Locate the content of corrupted sectors
• Play audio and CD+G tracks direct from all image files without
extracting while scanning, repairing, and locating errors
Features:
Cdmage supports multisession images

EC-Council
Cdmage: Screenshot

EC-Council
Alcohol
http://www.alcohol-soft.com/
Alcohol is a Windows CD and DVD burning software that creates backups of
DVDs and CDs

EC-Council
Nero
http://www.nero.com/
• Supports Blu-ray Disc and HD DVD burning
• Supports SecurDisc data protection
• Organizes and manages all your multimedia files, as well
as creates and edits new digital content
Features:
Nero is the CD/DVD burner software that creates exact
copy of the disc information

EC-Council
Nero: Screenshot

EC-Council
CD/DVD Data Recovery Tools
CDRoller
Badcopy Pro
Multi Data Rescue
InDisc Recovery
Stellar Phoenix -CD Data Recovery Software
CD Recovery Toolbox
IsoBuster
CD/DVD Inspector
Acodisc CD & DVD Data Recovery Services

EC-Council
CDRoller
http://www.cdroller.com/
CDRoller is the CD and DVD data recovery tool
It acts as a fault-tolerant data CD contents reader with capabilities to search
for lost data tracks
It offers extended UDF reading features with the capability to search and
recover lost files
The built-in CD Data Rescue tool allows you to recover the files and folders
from the damaged discs

EC-Council
CDRoller: Screenshot

EC-Council
Badcopy Pro
http://www.jufsoft.com/badcopy/
BadCopy Pro is a tool that is valuable to forensic investigators for
removable storage mediums
It does not write data to the original disc but to a location specified by
the user
It recovers files from floppy discs, CD-ROMs, CD-R/Ws, digital media,
zip discs, and other storage media
It can recover corrupted or lost data

EC-Council
Badcopy Pro: Screenshot

EC-Council
Multi Data Rescue
http://www.naltech.com/
Multi Data Rescue is a windows based application designed specifically
to recover files from damaged, scratched or defective discs, and digital
media
It supports data recovery from damaged CD-ROM, CD-R, CD-RW,
DVD-ROM, DVD-R, DVD-RW, DVD+R, DVD+RW, DVD-RAM, HD-
DVD-R, HD-DVD-RW, BD-R, and BD-RE discs
It supports digital media recovery, recovers lost or deleted files, photos
and videos from removable discs, USB discs, digital cameras and
phones, memory cards, etc.
It recovers unreadable and deleted files from discs recorded by
common disc writing software in ISO and UDF formats, including
Roxio Easy Creator and Ahead Nero

EC-Council
Multi Data Rescue: Screenshot

EC-Council
InDisc Recovery
http://www.octanesoft.com/
• Identifies and recovers deleted files from RW discs that have been deleted
through Quick Format mode
• Supports CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-R, DVD-RW, DVD+R,
DVD+RW, and DVD-RAM
• Easy-to-use interface, no special skill required, and supports multi-session
media
• Ability to preview Image, Ascii, and Hex data
Features:
InDisc Recovery is CD or DVD data recovery tool
It is specifically designed to recover any type of deleted, lost, or unreadable files
and folders from damaged, scratched, or defective CDs and DVDs

EC-Council
InDisc Recovery: Screenshot

EC-Council
Stellar Phoenix -CD Data Recovery
Software
http://www.stellarinfo.com/
• File recovery from damaged CDROM, CD-R, and CD-RW
• Data recovery when TOC (Table of Contents) is bad or damaged
• Provides data recovery even after primary volume descriptor and secondary volume
descriptor are corrupt or physically damaged
• Data recovery when data cannot be accessed and disc indicates that it is full
• Provides file recovery when disc has physical damages : scratch, bubbles, cracks, and
warping
• Provides CD data recovery when computer freezes while trying to read the disc
• Provides CD file recovery when disc has data but appears blank or is displayed as audio
disc
Features:
Stellar Phoenix - CD Data Recovery Software recovers data from damaged or defective CD-
ROM, CD-R, and CD-RW
It recovers data and file lost due to unreadable, scratched, corrupt, or defective CD media

EC-Council
Stellar Phoenix: Screenshot

EC-Council
CD Recovery Toolbox
http://www.oemailrecovery.com
CD Recovery Toolbox recovers damaged files from different disc types
It recovers files from damaged or corrupted CD/DVD/HD DVD/Blu-
Ray discs
It scans any CD and DVD discs and finds files and folders located in the
toolbox
• Recovers information from any CD and DVD discs
• Recovers files larger than 4 Gb
• Detects possible lack of free space on the hard disc for storing the
recovered files
Features:

EC-Council
CD Recovery Toolbox:
Screenshot

EC-Council
Tool: IsoBuster
www.smart-projects.net
IsoBuster is a CD/DVD and (Disc) Image File data recovery
tool
It rescues lost files from a bad or trashed CD or DVD or a Blu
Ray disc
It supports all CD/DVD File-Systems and enormous range of
image files
Features:
• Recovers data from all possible CD and DVD formats
• Supports for direct CD compressed files
IsoBuster performs two major functions:
• CD (DVD) backup
• Recovery

EC-Council
IsoBuster: Screenshot

EC-Council
CD/DVD Inspector
http://www.infinadyne.com/cddvd_inspector.html
CD/DVD Inspector reads all major CD and DVD filesystem
formats including ISO-9660, Joliet, UDF, HFS, and HFS+
Features:
• Complete CD imaging
• Supports creation of ZIP images from media
• Supports DVD Media Recovery
• File scanning
• Built-in Image Viewer
• Low-level sector examination and scanning

EC-Council
Acodisc CD & DVD Data Recovery
Services
http://www.acodisc.com/
Acodisc CD & DVD Data Recovery services help in data recovery and
repair of inaccessible, unreadable, or deleted data, video, files,
pictures, and documents
It recovers data from optical storage media such as:
• CD-ROM, CD-R, and CD-RW
• DVD-RAM, DVD-R/W, DVD+R/W, and 3-inch Mini CD-R
• Mini DVD-R/RAM Discs, Home Audio Recording CDs, Compact Flash-
CF), Smart Media (SSFDC), Sony memory sticks, and PCMCIA ATA Cards

EC-Council
Acodisc CD & DVD Data
Recovery Services (cont’d)
• Unreadable CD-ROM, CD-R, CD-RW, DVD-RAM, DVD-R/W, or 3-inch Mini
CD-R
• Data cannot be accessed but the disc indicates that it is full
• Accidental quick erased, quick formatted, or file deletion
• Files and/or directory can be seen but files cannot be moved or used on the
media
• Error dialog box says "Files do not exist"
• Corrupted or missing TOC (Table of Contents) or directory information
• Damaged or crossed sessions, caused by operator error
• Problems with your operating system or shuts down during write, causing CD
errors
• Physical damages: bubbles, cracks, scratches, warping
• When the media is put in the drive, the drive makes a loud whirring sound
• Computer freezes or locks up, while trying to read the media
• CD that had data on it, now incorrectly appears to be a blank or an audio CD
• Failed CDs from Home Audio Recorders
Acodisc services solve the problems such as:

EC-Council
Summary
A Compact Disc (CD) is an optical disc to store digital data
DVD has enough space to store a full-length, MPEG-2-encoded
movie, as well as other information
HD-DVD is a next-generation optical disc format designed for high-
density storage of high-definition video and data
An investigator may get some evidence such as fingerprints and
surface markings on the disc
IsoBuster is a CD/DVD and (Disc) Image File data recovery tool

EC-Council

File000123

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Andere mochten auch

Andere mochten auch (9)

Ähnlich wie File000123

Ähnlich wie File000123 (20)

Mehr von Desmond Devendran

Mehr von Desmond Devendran (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

File000123