File000123

323 views
235 views

Published on

0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
323
On SlideShare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
27
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

File000123

  1. 1. Module X – CD-DVD Forensics
  2. 2. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Module Objective • Compact Disc • DVD • How Criminals use CD/DVD for Crime • CD Forensics • CD/DVD Imaging Tool • CD/DVD Data Recovery Tools • Acodisc CD & DVD Data Recovery Services This module will familiarize you with:
  3. 3. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Module Flow Compact Disc CD/DVD Imaging Tool CD Forensics CD/DVD Data Recovery ToolsDVD Acodisc CD & DVD Data Recovery Services How Criminal uses CD/DVD for Crime
  4. 4. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Compact Disc A Compact Disc (CD) is an optical disc to store digital data It is made up of pure polycarbonate plastic disc In a CD, data is stored as a series of tiny indentations (pits), encoded in a tightly packed spiral track of pits molded into the top of the polycarbonate layer Infrared 780 nm laser is used to write data on a CD
  5. 5. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Types of CDs • Each CD-ROM sector is 2352 bytes, and contains 2048 bytes of PC Data, 2336 bytes of PSX/VCD Data, or 2352 bytes of AUDIO • A standard 120 mm CD-ROM holds 650 or 700 MB of data Compact Disc Read-Only Memory (CD-ROM) • CD-R is a compact disc format that allows only one time recording on the disc CD-R • CD-RW (for compact disc, rewriteable) is a compact disc (CD) format that allows repeated recording on a disc • CD-RW discs usually hold 74 minutes (650 MB) of data, although some can hold up to 80 minutes (700 MB) and can be rewritten as many as 1000 times CD-R/W
  6. 6. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Digital Versatile Disc (DVD) DVD is an optical disc technology with a 4.7 gigabyte storage capacity on a single-sided, one- layered disc A double-sided, two-layered DVD will hold up to 17 gigabytes of video, audio, or other information DVD has enough space to store a full-length, MPEG-2-encoded movie, as well as other information Like a CD, the data on a DVD is encoded in the form of small pits and bumps on the track of the disc DVDs can store more data than CDs because of: • Higher-density data storage • Less overhead, more area • Multi-layer storage
  7. 7. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited DVD-R and DVD+R • DVD-R disc formats can only be written to once, and then it is only readable • DVD-R is a DVD recordable format having 4.7 GB storage capacity • It can only be written to in one layer on the disc’s surface • DVD-R standard was developed by Pioneer, and is used primarily by Apple and Pioneer DVD-R: • A DVD+R is a writable optical disc with 4.7 GB of storage capacity • DVD+R discs can be written only once • These discs can be written to in multiple layers, giving slightly better and more disc storage • DVD+R format is supported by Philips, Dell, Sony, HP, and Microsoft DVD+R:
  8. 8. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited DVD-RW and DVD+RW • A DVD-RW is a rewritable optical disc with storage capacity equal to a DVD-R, typically 4.7 GB • Not all DVD players can read DVD-RWs • The recording in a DVD-RW needs an initialization and termination process • To start recording in a DVD-RW, it is necessary to format the disc entirely DVD-RW: • A DVD+RW is a rewritable optical disc with storage capacity equal to a DVD+R, typically 4.7 GB • DVD+R discs are compatible with most DVD players • In the recording of a DVD+RW, neither the initialization process nor the finalization is necessary DVD+RW: Both discs are used for large data storage such as backups
  9. 9. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited DVD+R DL, DVD-R DL, DVD- RAM • DVD+R DL or DVD+R9 is a Dual Layer writeable DVD+R • DVD-9: • The dual layered discs can hold 7.95 GB data • DVD-18: • The dual layered double sides discs can hold 15.9 GB data DVD+R DL: • DVD-R DL or DVD-R9 is a Dual Layer writeable DVD-R • The dual layered discs can hold 7.95 computer GB called DVD-9 and dual layered double sides 15.9 called dvd-18 DVD-R DL: • DVD-RAM (DVD-Random Access Memory) is a rewritable form that can be rewritten over 100,000 times • It has the best recording features but it is not compatible with most DVD-ROM drives and DVD-Video players • It is usually used in some DVD Recorders DVD-RAM:
  10. 10. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Blu-Ray Blu-ray is the next-generation digital video disc patented by SONY With their high storage capacity, Blu-ray discs can hold and play back large quantities of high-definition video and audio, photos, and other digital content Blu-Ray discs use 405 nanometer blue-violet lasers A single-layer Blu-ray disc can hold up to 27 GB of data and a double-layer Blu-ray disc can store up to 50 GB of data
  11. 11. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Blu-Ray (cont’d) • Records high-definition television (HDTV) without any loss in quality • Instantly skips to any spot on the disc • Records one program while watching another on the disc • Creates playlists • Edits or reorders programs recorded on the disc • Automatically searches for an empty space on the disc to avoid recording over a program • Accesses the web to download subtitles and other extra features Advantages:
  12. 12. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited SID Code SID code is a four character code that identifies the source of music and manufacturer It can be applied to all CD and DVD, including all recordable forms of CD and DVD It works as an anti-piracy tool
  13. 13. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited How Criminals use CD/DVD for Crime To store illegal material To store the pornographic images and videos To keep the critical information about the organization Software piracy To keep the contact details of other criminals
  14. 14. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Pre-Requisite for CD/DVD Forensics To conduct an examination of the digital evidence on CD or DVD media, the following hardware, software, and workstation are mandatory Forensic Hardware: • CD-RW • DVD writer that can read both DVD+ and DVD– media Forensic Software: • AccessData Forensic Tool Kit (FTK) • EnCase • ILook Investigator Forensic Workstation: • Proper Basic Input Output System (BIOS) configuration • No conflicting software • No contaminating data • The time and date synchronized properly • Properly licensed software
  15. 15. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Steps for CD Forensics Data Analysis Recover data from damaged or corrupted CDs/DVDs Create image of CD/DVD Preserve the evidence Document the scene Collect the CD/DVD evidence
  16. 16. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Collect the CD/DVD evidence Collect the CD/DVD material available at the incident Collect non-electronic evidence such as written passwords, handwritten notes, computer printouts, and so on Keep the evidence at secure place and protect them from damage
  17. 17. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Precautions while Collecting the Evidence Hold CD/DVD only by outer edges and center hole to avoid scratches Use water-based markers for writing on discs Stack the discs on spindles Take special precautions with discs that are cracked Rinse discs with distilled water to remove surface dirt, possible drug contamination, grease, and/or oils Do not use any type of cleaner based on organic or petroleum solvents
  18. 18. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Document the Scene Document the state of the device during seizure Photograph the evidence Maintain chain of custody of documents, photographs, and evidence Check the discs for evidence such as fingerprints and surface markings on the disc Photograph the surface of a disc Photograph the label side of a disc, markings that are placed by the person writing the disc
  19. 19. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Preserve the Evidence Keep the discs away from magnetic fields Keep the discs away from sunlight Secure the discs from mechanical or electrical shock Protect the evidence from unauthorized users
  20. 20. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Create Image of CD/DVD Create the image of data in the discs in order to prevent damage to the original data Use different image making tools such as UltraISO and Nero Use hashing techniques to ensure that binary image is an exact bit-for- bit copy of the original
  21. 21. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Recover Data from Damaged or Corrupted CDs/DVDs Recover data from damaged or corrupted CDs/DVDs Recover data from images of the discs in order to prevent damage to the original data Use different data recovery tools such as Multi Data Rescue and CDRoller
  22. 22. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Data Analysis Recover the hidden information Use the steganalysis tools such as Stegdetect to extract the hidden information Use cryptanalysis tools such as Crank and Jipher to reveal the encrypted information Use the password cracking tools such as Cain, Abel, and Hydra to ensure if the information is password protected If the data is in audio or video format, use different audio/video players Check for the creation and modification time of the file and the author of the files Find out: • What exactly happened? • When event occurred? • Who were involved? • How it occurred?
  23. 23. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Identify Pirated CD/DVDs • No record company logos • SID Code obliterated or no SID Codes • Poor-quality inlay and graphics, often 2 color print only that can be peeled off • Poor paper quality • Promo versions • Incomplete, incorrect, or no licensing or trademark details • Copyright holder not mentioned, incorrect, or fictitious • Discrepancies between disc and packaging • Incorrect spellings • Artist name or album title is incomplete or cropped off the disc You can identify pirated CD/DVDs by checking the following points:
  24. 24. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Identify Pirated CD/DVDs (cont’d) More than one artist’s full album on a disc DVD contains more than one film on a disc of different production companies Low cost No plastic ‘jewel’ case CDs, plastic cases, and inlay cards packed separately Discrepancies on inlay card relating to information from other films Disc is a CD-R/DVD-R “All” zone region code Release date of title - Film is currently in cinemas Zone 1 logos and Asian or Cyrillic characters
  25. 25. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Original and Pirated CD/DVDs Pirated CDOriginal CD
  26. 26. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited CD/DVD Imaging Tools UltraISO MagicISO Cdmage Alcohol Nero
  27. 27. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited UltraISO http://www.ezbsystems.com/ultraiso/ • Can create CD/DVD image from CD/DVD-ROM and maintain bootable information • Build files/folders to one ISO File • Edit and convert ISO file in many formats • Make bootable CD/DVDs • Create/edit audio CD image Features: UltraISO is an ISO CD/DVD image file creating/editing/converting tool, and a bootable CD/DVD maker It can directly edit the CD/DVD image file and extract files and folders from it, as well as directly make ISO files from your CD/DVD-ROM or hard disc
  28. 28. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited UltraISO: Screenshot
  29. 29. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited MagicISO http://www.magiciso.com/ MagicISO is a CD/DVD image file creating/editing/extracting tool It helps to make CD/DVD image from DVD/CD-ROM to hard disc in order to back up CD/DVD or use it with virtual CD or virtual machine • Support all known CD image type • Directly edit CD/DVD image file • Make bootable CD/DVD Features:
  30. 30. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited MagicISO: Screenshot
  31. 31. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Cdmage http://cdmage.orconhosting.net.nz/ • Extract and convert tracks into any compatible supported format • Extract files from data tracks • Compare files with files burned on the CD or with files on the HD • Locate the content of corrupted sectors • Play audio and CD+G tracks direct from all image files without extracting while scanning, repairing, and locating errors Features: Cdmage supports multisession images
  32. 32. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Cdmage: Screenshot
  33. 33. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Alcohol http://www.alcohol-soft.com/ Alcohol is a Windows CD and DVD burning software that creates backups of DVDs and CDs
  34. 34. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Nero http://www.nero.com/ • Supports Blu-ray Disc and HD DVD burning • Supports SecurDisc data protection • Organizes and manages all your multimedia files, as well as creates and edits new digital content Features: Nero is the CD/DVD burner software that creates exact copy of the disc information
  35. 35. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Nero: Screenshot
  36. 36. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited CD/DVD Data Recovery Tools CDRoller Badcopy Pro Multi Data Rescue InDisc Recovery Stellar Phoenix -CD Data Recovery Software CD Recovery Toolbox IsoBuster CD/DVD Inspector Acodisc CD & DVD Data Recovery Services
  37. 37. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited CDRoller http://www.cdroller.com/ CDRoller is the CD and DVD data recovery tool It acts as a fault-tolerant data CD contents reader with capabilities to search for lost data tracks It offers extended UDF reading features with the capability to search and recover lost files The built-in CD Data Rescue tool allows you to recover the files and folders from the damaged discs
  38. 38. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited CDRoller: Screenshot
  39. 39. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Badcopy Pro http://www.jufsoft.com/badcopy/ BadCopy Pro is a tool that is valuable to forensic investigators for removable storage mediums It does not write data to the original disc but to a location specified by the user It recovers files from floppy discs, CD-ROMs, CD-R/Ws, digital media, zip discs, and other storage media It can recover corrupted or lost data
  40. 40. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Badcopy Pro: Screenshot
  41. 41. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Multi Data Rescue http://www.naltech.com/ Multi Data Rescue is a windows based application designed specifically to recover files from damaged, scratched or defective discs, and digital media It supports data recovery from damaged CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-R, DVD-RW, DVD+R, DVD+RW, DVD-RAM, HD- DVD-R, HD-DVD-RW, BD-R, and BD-RE discs It supports digital media recovery, recovers lost or deleted files, photos and videos from removable discs, USB discs, digital cameras and phones, memory cards, etc. It recovers unreadable and deleted files from discs recorded by common disc writing software in ISO and UDF formats, including Roxio Easy Creator and Ahead Nero
  42. 42. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Multi Data Rescue: Screenshot
  43. 43. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited InDisc Recovery http://www.octanesoft.com/ • Identifies and recovers deleted files from RW discs that have been deleted through Quick Format mode • Supports CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-R, DVD-RW, DVD+R, DVD+RW, and DVD-RAM • Easy-to-use interface, no special skill required, and supports multi-session media • Ability to preview Image, Ascii, and Hex data Features: InDisc Recovery is CD or DVD data recovery tool It is specifically designed to recover any type of deleted, lost, or unreadable files and folders from damaged, scratched, or defective CDs and DVDs
  44. 44. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited InDisc Recovery: Screenshot
  45. 45. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Stellar Phoenix -CD Data Recovery Software http://www.stellarinfo.com/ • File recovery from damaged CDROM, CD-R, and CD-RW • Data recovery when TOC (Table of Contents) is bad or damaged • Provides data recovery even after primary volume descriptor and secondary volume descriptor are corrupt or physically damaged • Data recovery when data cannot be accessed and disc indicates that it is full • Provides file recovery when disc has physical damages : scratch, bubbles, cracks, and warping • Provides CD data recovery when computer freezes while trying to read the disc • Provides CD file recovery when disc has data but appears blank or is displayed as audio disc Features: Stellar Phoenix - CD Data Recovery Software recovers data from damaged or defective CD- ROM, CD-R, and CD-RW It recovers data and file lost due to unreadable, scratched, corrupt, or defective CD media
  46. 46. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Stellar Phoenix: Screenshot
  47. 47. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited CD Recovery Toolbox http://www.oemailrecovery.com CD Recovery Toolbox recovers damaged files from different disc types It recovers files from damaged or corrupted CD/DVD/HD DVD/Blu- Ray discs It scans any CD and DVD discs and finds files and folders located in the toolbox • Recovers information from any CD and DVD discs • Recovers files larger than 4 Gb • Detects possible lack of free space on the hard disc for storing the recovered files Features:
  48. 48. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited CD Recovery Toolbox: Screenshot
  49. 49. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Tool: IsoBuster www.smart-projects.net IsoBuster is a CD/DVD and (Disc) Image File data recovery tool It rescues lost files from a bad or trashed CD or DVD or a Blu Ray disc It supports all CD/DVD File-Systems and enormous range of image files Features: • Recovers data from all possible CD and DVD formats • Supports for direct CD compressed files IsoBuster performs two major functions: • CD (DVD) backup • Recovery
  50. 50. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited IsoBuster: Screenshot
  51. 51. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited CD/DVD Inspector http://www.infinadyne.com/cddvd_inspector.html CD/DVD Inspector reads all major CD and DVD filesystem formats including ISO-9660, Joliet, UDF, HFS, and HFS+ Features: • Complete CD imaging • Supports creation of ZIP images from media • Supports DVD Media Recovery • File scanning • Built-in Image Viewer • Low-level sector examination and scanning
  52. 52. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Acodisc CD & DVD Data Recovery Services http://www.acodisc.com/ Acodisc CD & DVD Data Recovery services help in data recovery and repair of inaccessible, unreadable, or deleted data, video, files, pictures, and documents It recovers data from optical storage media such as: • CD-ROM, CD-R, and CD-RW • DVD-RAM, DVD-R/W, DVD+R/W, and 3-inch Mini CD-R • Mini DVD-R/RAM Discs, Home Audio Recording CDs, Compact Flash- CF), Smart Media (SSFDC), Sony memory sticks, and PCMCIA ATA Cards
  53. 53. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Acodisc CD & DVD Data Recovery Services (cont’d) • Unreadable CD-ROM, CD-R, CD-RW, DVD-RAM, DVD-R/W, or 3-inch Mini CD-R • Data cannot be accessed but the disc indicates that it is full • Accidental quick erased, quick formatted, or file deletion • Files and/or directory can be seen but files cannot be moved or used on the media • Error dialog box says "Files do not exist" • Corrupted or missing TOC (Table of Contents) or directory information • Damaged or crossed sessions, caused by operator error • Problems with your operating system or shuts down during write, causing CD errors • Physical damages: bubbles, cracks, scratches, warping • When the media is put in the drive, the drive makes a loud whirring sound • Computer freezes or locks up, while trying to read the media • CD that had data on it, now incorrectly appears to be a blank or an audio CD • Failed CDs from Home Audio Recorders Acodisc services solve the problems such as:
  54. 54. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Summary A Compact Disc (CD) is an optical disc to store digital data DVD has enough space to store a full-length, MPEG-2-encoded movie, as well as other information HD-DVD is a next-generation optical disc format designed for high- density storage of high-definition video and data An investigator may get some evidence such as fingerprints and surface markings on the disc IsoBuster is a CD/DVD and (Disc) Image File data recovery tool
  55. 55. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
  56. 56. EC-Council Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited

×