Descripciones mejoradas de Syndetics:

CD and DVD Forensics will take the reader through all facets of handling, examining, and processing CD and DVD evidence for computer forensics. At a time where data forensics is becoming a major part of law enforcement and prosecution in the public sector, and corporate and system security in the private sector, the interest in this subject has just begun to blossom.

CD and DVD Forensics is a how to book that will give the reader tools to be able to open CDs and DVDs in an effort to identify evidence of a crime. These tools can be applied in both the public and private sectors. Armed with this information, law enforcement, corporate security, and private investigators will be able to be more effective in their evidence related tasks. To accomplish this the book is divided into four basic parts: (a) CD and DVD physics dealing with the history, construction and technology of CD and DVD media, (b) file systems present on CDs and DVDs and how these are different from that which is found on hard disks, floppy disks and other media, (c) considerations for handling CD and DVD evidence to both recover the maximum amount of information present on a disc and to do so without destroying or altering the disc in any way, and (d) using the InfinaDyne product CD/DVD Inspector to examine discs in detail and collect evidence.

Tabla de contenidos provista por Syndetics

• Foreword(p. xxi)
• Chapter 1 Physical Characteristics of CD and DVD Media(p. 1)
• CD Features(p. 4)
• CD Sizes and Shapes(p. 6)
• CD and DVD Types(p. 7)
• CD and DVD Colors(p. 8)
• CD-R Dyes(p. 9)
• Information Storage on CDs and DVDs(p. 11)
• CD and DVD Organization and Terminology(p. 12)
• Border Zone(p. 12)
• Lead In(p. 13)
• Lead Out(p. 13)
• Philips CD Text(p. 13)
• RZone(p. 14)
• Sector(p. 14)
• Session(p. 14)
• Sony CD Text(p. 14)
• TOC(p. 14)
• Track(p. 14)
• CD and DVD Sectors(p. 15)
• R-W Subchannels(p. 16)
• CD and DVD Differences(p. 19)
• CD-ROM Manufacturing Process(p. 20)
• Inside a CD-ROM Drive(p. 23)
• External Interfaces(p. 26)
• Drive Firmware(p. 27)
• Chapter 2 CD and DVD Logical Structure(p. 29)
• Writing to a CD or DVD(p. 30)
• Logical File Systems(p. 32)
• CD and DVD File Systems(p. 35)
• Red Book Audio(p. 35)
• HSG(p. 36)
• ISO 9660(p. 37)
• Joliet(p. 39)
• Rock Ridge(p. 40)
• UDF(p. 43)
• HFS(p. 46)
• HFS+(p. 47)
• El Torito(p. 47)
• Space Allocation by CD and DVD File Systems(p. 48)
• Disc Accessibility Problems(p. 50)
• ISO 9660/Joliet File Systems(p. 50)
• UDF File Systems(p. 51)
• Other File Systems(p. 51)
• Chapter 3 Forensic Binary Images(p. 53)
• Reproducing Forensic Images(p. 55)
• Chapter 4 Collecting CD and DVD Evidence(p. 57)
• Recognizing CD and DVD Media(p. 58)
• Collection Considerations(p. 58)
• Marking Discs(p. 59)
• Transporting Discs(p. 60)
• Documenting and Fingerprinting Discs(p. 61)
• Officer Safety(p. 62)
• Chapter 5 Preparing for Disc Examination(p. 63)
• Forensic Hardware(p. 64)
• Forensic Software(p. 65)
• Forensic Workstation(p. 66)
• Validation(p. 67)
• Disc Triage(p. 67)
• Chapter 6 CD/DVD Inspector - The Basics(p. 73)
• CD/DVD Inspector Installation(p. 74)
• CD/DVD Inspector Facts(p. 74)
• Getting Started with CD/DVD Inspector(p. 75)
• Data Window Usage(p. 80)
• Disc Memory(p. 81)
• Useful Tools(p. 83)
• Analysis(p. 83)
• Compute Disc MD5(p. 83)
• Compute MD5 Hash(p. 84)
• Disc Map(p. 84)
• Disc Report(p. 84)
• Hardware Information(p. 84)
• Scan Files(p. 84)
• Sector Display(p. 84)
• TOC(p. 85)
• View Image(p. 85)
• Write Image File(p. 86)
• Searching(p. 86)
• Scan Files(p. 87)
• Producing a Forensic Image(p. 92)
• Copying Files from the Media(p. 95)
• User Preferences(p. 96)
• Options Settings(p. 96)
• Remove Version Marker from Files(p. 97)
• Show Analysis File Details(p. 97)
• Save Window Position(p. 98)
• Sort Initial Display by Name(p. 98)
• Accept All Errors without Prompting(p. 98)
• Always Prompt for Filename on Copy(p. 99)
• Force-intensive UDF Examination(p. 99)
• Keep Duplicate Files from UDF Examination(p. 99)
• Automatically Examine Disc at Startup(p. 100)
• Enable Special Features(p. 100)
• Recover without Prompts(p. 100)
• Show Extents in Disc Reports(p. 101)
• Disable Disc Memory Feature(p. 101)
• Forensic Use(p. 101)
• Use 64-bit .zip Extensions for .zip Image Files(p. 101)
• Disc Memory Settings(p. 102)
• Keep Last Discs in Disc Memory(p. 102)
• Empty Button(p. 102)
• Click to Delete a Single Item(p. 103)
• Disc Memory Catalog(p. 103)
• The Analysis Tool(p. 103)
• name File System in Track nn Recorded as Part of
• Session nn(p. 104)
• nnnnn Sectors are Used Out of nnnnn Available Sectors(p. 104)
• type (media) load nnnn at Oxnnnn from Sector nnnn(p. 104)
• A Properly Written Post-gap was Found For This Track(p. 105)
• All Linked Files (nnnn) in this Session Came from Session nn(p. 105)
• Application Identification(p. 105)
• ATIP Reference Power = nn
• Reference Speed = nn(p. 106)
• Blank Disc with nnnnn Free Sectors(p. 106)
• Bootable Disc Information Found, Boot Catalog at Sector nnn(p. 106)
• Bootable Media from company, platform=platform(p. 106)
• The CDDB Key for this CD is xxxxxxxx(p. 106)
• Data Preparer Identification: ssssssss(p. 107)
• Disc is a DVD-kind Type is type(p. 107)
• Disc Manufacturer: ssssss Type: ssssss(p. 107)
• DVD Manufacturer is ssssss(p. 107)
• Error nnn in Manufacturer Determination, Manufacturer Information Not Available(p. 107)
• Error Reading Boot Catalog, Sense=0xnn 0xnn(p. 108)
• Error Reading File System Data from Disc, No Further Information Available(p. 108)
• Error Reading Sector nnnnn in Track nn, Analysis of Track Skipped(p. 108)
• Error Returned Obtaining ISRC Code, Sense = ss ss(p. 108)
• File ssssss is Linked to Track nnn, Session nn(p. 109)
• HFS Volume Name ssssss(p. 109)
• Image File in type Format: ssssss(p. 109)
• Invalid Boot Catalog Found, Key Values = 0xnn 0xnn(p. 109)
• Lead-out Track Starts at Sector nnnnn(p. 109)
• Little-endian Block Size (nnnn) Not Equal to Big-endian Block Size (nnnn)(p. 109)
• Little-endian Volume Size (nnnnn) Not Equal to Big-endian Volume Size (nnnnn)(p. 110)
• Media Catalog Number for this Disc is ssssss(p. 110)
• Minimum Recording Speed = nnX, Maximum Recording Speed = nnX(p. 110)
• Mismatched File Counts Between this File System and the ssssss File System(p. 111)
• Next Writable Location on Disc is nnnnn(p. 111)
• No Directory Was Found for This File System(p. 111)
• No ISRC/RID Code Present for This Track(p. 111)
• No Manufacturer Information was Returned for This Disc(p. 111)
• None of the Files in This Session Are Linked to Prior Sessions(p. 112)
• Note: Directory Depth of nn May Cause Problems on Some MSCDEX Versions(p. 112)
• Note: Directory Depth of nn Violates ISO-9660 Limit of Eight(p. 112)
• One or More Files are Using Characters Which MS-DOS Cannot Access(p. 112)
• One or More Files Do Not Have a Trailing Version Identifier (";1")(p. 113)
• Partition Name: ssssss(p. 113)
• Publisher Identification(p. 113)
• Rock Ridge Extension Information is Present(p. 113)
• Table of Contents(p. 113)
• The "." Directory Entry is Missing From One or More Directories(p. 114)
• The ".." Directory Entry is Missing From One or More Directories(p. 114)
• The tttttt Code for This Track is cccccc(p. 114)
• The Block Size is nnnn, Not 2048 as Would Be Expected(p. 114)
• The Directory in This File System Qualifies as Using the setname Character Set(p. 115)
• The Disc Is Not Recorded in XA Mode, But This File System is Marked for XA Mode(p. 115)
• The Disc Is Recorded in XA Mode, But This File System Is Not Marked for XA Mode(p. 115)
• The File "ssssss" Appears in the Directory But is Not Present(p. 116)
• The Files ssssss and ssssss Overlap and One or Both are Destroyed(p. 116)
• The Last Track in the Table of Contents is Not the Lead-out(p. 116)
• The Mastering Program for this Disc Did Not Place Version Numbers (";1") After the Filenames(p. 117)
• The Post-gap for This Disc is Either Missing or Invalid, nnn Trailing Sectors Found(p. 117)
• The System Identifier in the ISO-9660 Volume Descriptor Contains Other Than "a" Characters(p. 117)
• The Volume Identifier in the ISO-9660 Volume Descriptor Contains Other Than "d" Characters(p. 117)
• The Volume Identifier is Blank. This May Cause Problems(p. 118)
• There Appear To Be Additional Boot Definitions Present(p. 118)
• There are nnn Files in the Directory Which Are Not Recorded in This File System(p. 118)
• There are nnn Accessible Files and nnn Directories Contained in This File System(p. 119)
• There are nnn Directories in This File System(p. 119)
• There are nnn Files in This File System(p. 119)
• There are nnn Files Linked from Session nn(p. 119)
• There are nnn Files That Could Not Be Connected to a Filename(p. 119)
• There are nnnn Free Sectors in This Track(p. 119)
• There is a Total of nnn File Systems on Disc(p. 120)
• This Disc Appears to be "Open" and Can Have Data Added to It. The Pointer is nnnnn(p. 120)
• This Disc Has nn Layers(p. 120)
• This Disc Is Still "Open" and Can Have Data Added To It(p. 120)
• This File System Contains Compressed Data(p. 120)
• This File System Was Written by ssssss(p. 121)
• This File System Was Written by Packet-writing Software(p. 121)
• This Track Contains Audio with Pre-emphasis(p. 121)
• This Track Contains Audio without Pre-emphasis(p. 121)
• This Track Contains Data and Contains ssssss File System(s)(p. 121)
• This Track Contains Data from the File System in the Prior Track(p. 122)
• This Track Has Been Recorded in XA Mode(p. 122)
• This Track is Marked as Being Blank(p. 122)
• Track nn Has Been Added to Represent an Open Session(p. 122)
• Track nn is an Audio Track(p. 123)
• Track nn Occupies nnn sectors (nn Min, nn Sec, nn Frames)(p. 123)
• Track Contains MCN of nnnnnn(p. 123)
• Track Image Written with nnnn Byte Sectors(p. 123)
• Track Was Written with Fixed-length Packets nnnn Bytes in Length(p. 123)
• Track Was Written with Variable-length Packets(p. 123)
• UDF Examination Error: ssssss(p. 124)
• UDF Partition Exceeds Size of
• Track According To Disc Information(p. 124)
• Volume Create Date date(p. 124)
• Volume Size Appears Suspicious; Header Says nnnnn While Track is nnnnn Sectors(p. 124)
• Warning: One or More Checksum Errors were Detected in the UDF Structures(p. 124)
• Warning: Root Directory Length is Specified as Zero(p. 125)
• Warning: This Disc is Marked as Having a Sparable Partition, But No Sparing Information Table is Present(p. 125)
• Warning: Virtual Allocation Table Missing(p. 125)
• Warning: VAT Not Found in Conventional Place(p. 125)
• Whole Disc MD5 Hash Value xxxxxxxxxxxxxxxxx(p. 126)
• The Hardware Information Display(p. 126)
• Device Name(p. 126)
• Revision(p. 126)
• Date of Revision(p. 127)
• Read CDDA Command(p. 127)
• "RAW read" Command(p. 127)
• Track Information Command(p. 127)
• Using 10- Byte Commands(p. 127)
• Readability Test Reason Code(p. 128)
• Loading Mechanism(p. 128)
• Bar Code Reading Supported(p. 128)
• UPC Code is Read(p. 128)
• ISRC Code is Read(p. 128)
• C2 Error Pointers(p. 128)
• Maximum Reading Speed(p. 129)
• Multi-session Capable(p. 129)
• Mode 2 Form 1 Supported(p. 129)
• Mode 2 Form 2 Supported(p. 129)
• Digital Output on Port 1(p. 129)
• Digital Output on Port 2(p. 129)
• Audio Play Supported(p. 130)
• Reading CDDA Supported(p. 130)
• CD-Text/CD+G Supported(p. 130)
• CD-Text/CD+G Decoded(p. 130)
• Accurate CDDA Positioning(p. 130)
• Transfer Block Supported(p. 131)
• Inactivity Spin-down(p. 131)
• Device Capabilities(p. 131)
• Device Buffer Size (in K)(p. 131)
• Drive Serial Number(p. 131)
• The Volume Information Display(p. 131)
• ISO-9660 Volume Information(p. 132)
• Volume ID(p. 132)
• System ID(p. 132)
• Volume Size(p. 133)
• System Use(p. 133)
• Volume Set Size(p. 133)
• Volume in Set(p. 133)
• Block Size (Bytes)(p. 133)
• Path Table Size (Bytes)(p. 134)
• Path Table (L)(p. 134)
• Optional Path Table (L)(p. 135)
• Path Table (M)(p. 135)
• Optional Path Table (M)(p. 135)
• Root Directory Sector(p. 135)
• Root Directory Timestamp(p. 135)
• Volume Set(p. 135)
• Publisher(p. 136)
• Data Preparer(p. 136)
• Application(p. 136)
• Copyright File(p. 136)
• Abstract File(p. 137)
• Bibliography File(p. 137)
• Volume Created(p. 137)
• Volume Modified(p. 138)
• Volume Expires(p. 138)
• Volume Effective(p. 138)
• Volume Size(p. 138)
• Volume Set Size(p. 138)
• Volume in Set(p. 138)
• Block Size (Bytes)(p. 139)
• Path Table Size (Bytes)(p. 139)
• Root Directory Sector(p. 139)
• Joliet Volume Information(p. 139)
• Volume ID(p. 139)
• System ID(p. 139)
• Volume Size(p. 140)
• System Use(p. 140)
• Volume Set Size(p. 140)
• Volume in Set(p. 141)
• Block Size (Bytes)(p. 141)
• Path Table Size (Bytes)(p. 141)
• Path Table (L)(p. 141)
• Optional Path Table (L)(p. 142)
• Path Table (M)(p. 142)
• Optional Path Table (M)(p. 142)
• Root Directory Sector(p. 142)
• Root Directory Timestamp(p. 143)
• Volume Set(p. 143)
• Publisher(p. 143)
• Data Preparer(p. 143)
• Application(p. 144)
• Copyright File(p. 144)
• Abstract File(p. 144)
• Bibliography File(p. 145)
• Volume Created(p. 145)
• Volume Modified(p. 145)
• Volume Expires(p. 146)
• Volume Effective(p. 146)
• Volume Size(p. 146)
• Volume Set Size(p. 146)
• Volume in Set(p. 146)
• Block Size (Bytes)(p. 146)
• Path Table Size (Bytes)(p. 146)
• Root Directory Sector(p. 147)
• HFS and HFS+ Volume Information(p. 147)
• Volume ID(p. 147)
• Files(p. 147)
• Directories(p. 147)
• Allocation Size (Bytes)(p. 147)
• Allocation Blocks(p. 147)
• Free Blocks(p. 148)
• Volume Created(p. 148)
• Volume Modified(p. 148)
• HSG Volume Information(p. 148)
• UDF Volume Information(p. 148)
• Volume Descriptor Sequence(p. 148)
• Volume ID(p. 148)
• Interchange Level(p. 149)
• Volume Set Name(p. 149)
• Implementation Identifier(p. 149)
• Application(p. 149)
• Recording Time(p. 149)
• Disc Reports(p. 149)
• Disc Contents by Folder(p. 151)
• Disc Contents by Name(p. 152)
• Disc Contents by Extension(p. 153)
• Files with MD5 Hash Value(p. 154)
• CSV Format Export(p. 155)
• Image Reports(p. 156)
• Chapter 7 Using CD/DVD Inspector(p. 159)
• Examining a Disc-A Step-by-step Guide(p. 160)
• Starting CD/DVD Inspector(p. 160)
• Initial Observations(p. 161)
• Analysis Tool(p. 161)
• Disc Map(p. 162)
• Quick Image Examination(p. 162)
• Scan Files for Keywords(p. 163)
• Other Examination Tasks(p. 163)
• Create an ISO Image File(p. 163)
• Create an InfinaDyne Image File(p. 164)
• Determining the Writing Application(p. 165)
• Date Correspondence(p. 165)
• Missing Files(p. 166)
• Multi-Session Hiding(p. 167)
• Chapter 8 Advanced Tasks with CD/DVD Inspector(p. 169)
• Using Hash Matching and MD5 Hashes(p. 170)
• Space Utilization Analysis(p. 171)
• ISO-9660 Directory Analysis(p. 176)
• Unknown Data Track Issues(p. 179)
• Chapter 9 Reporting Your Findings(p. 181)
• Full List of All Files on the Media(p. 182)
• Image Report(s)(p. 183)
• Analysis Report(p. 183)
• Scan Files Results(p. 184)
• Raw Search Results(p. 184)
• Chapter 10 Things to Keep In Mind(p. 185)
• Appendix A Disc Swap Drive Modification(p. 187)
• Appendix B Downloading Additional Materials(p. 195)
• Glossary(p. 197)
• Index(p. 283)

Notas de autor provistas por Syndetics

Paul Crowley is the founder and lead developer at InfinaDyne. InfinaDyne is one of a small number of companies publishing software specifically targetted at the forensic examiner. He has been working in the software development field since 1975. His career includes experience that spans computer hardware from the very smallest home video game console to the largest IBM mainframes. Paul began working with CD recording technology in 1994 and is one of a small number of respected authorities on this technology. The first CD data recovery software product was written by Paul and has led the market for such tools since 1997. InfinaDyne has been offering CD and DVD Forensics training classes since 2005 and has held classes in the US and Australia. Attendees at these classes have included members of the FBI, US Department of Defense, and the Australian Federal Police.