Thursday, August 16, 2012

ISO9660 - Primary Volume Descriptor

CDs and DVDs might not be as popular these days as they used to be, but their structure is very interesting from a forensic point-of-view when someone is learning about data structures.  It is interesting how a value can be saved in little-endian and in big-endian formats to provide access regardless of the platform.  The date and time stamps are also not in "standard format" that we seen in most forensic investigations on storage devices.  The application identifier might also be of use in investigations.

 


BytePosition  Field Name  Content
1 Volume Descriptor Type 1
2 - 6  Standard Identifier CD001
7  Volume Descriptor Version 1
8  Unused Field  (00)17  byte
9 - 40  System Identifier  a-characters allowed18
41 - 72  Volume Identifier  d-characters allowed19
73 - 80  Unused Field  (00) bytes
81 - 88  Volume Space Size  Number of logical blocks in the Volume
89 - 120  Unused Field  (00) bytes
121 - 124  Volume Set Size  The assigned Volume Set size of the Volume
125 - 128  Volume Sequence Number  The ordinal number of the volume in the Volume Set
129 - 132  Logical Block Size  The size in bytes of a Logical Block
133 - 140  Path Table Size  Length in bytes of the path table
141 - 144  Location of Type L Path Table  Logical Block Number of first Block allocated to the Type L
Path Table, Type L meaning multiple byte numerical values are
recorded with least significant byte first.  This value is also
recorded with least significant byte first.
145 - 148  Location of Optional Type L Path Table 0 if Optional Path Table was not recorded, otherwise, Logical
Block Number of first Block allocated to the Optional Type L
Path Table.
149 - 152  Location of Type M Path Table  Logical Block Number of first Block allocated to the Type M
Path Table, Type M meaning multiple byte numerical values are
recorded with most significant byte first.  This value is also
recorded with most significant byte first.
153 - 156  Location of Optional Type M Path Table 0 if Optional Path Table was not recorded, otherwise, Logical
Block Number of first Block allocated to the Type M Path Table.
157 - 190  Directory record for Root Directory  This is the actual directory record for the top of the directory
structure.  See the section on directory records for the format of this data.
191 - 318  Volume Set Identifier  Name of the multiple volume set of which this volume is a
member.  d-characters allowed.
319 - 446  Publisher Identifier  Identifies who provided the actual data contained in the files.  a-characters allowed.
447 - 574  Data Preparer Identifier  Identifies who performed the actual creation of the current
volume. a-characters allowed.
575 - 702  Application Identifier  Identifies the specification of how the data in the files are
recorded.  For example, this field might contain SGML if the
files were recorded according to the Standard Generalized Markup
Language
703 - 739  Copyright File Identifier  Identifies the file in the root directory that contains the
copyright notice for this volume.  If there is no copyright file,
this field should contain all spaces (20) Level 1 interchange
restrictions apply.20
740 - 776  Abstract File Identifier  Identifies the file in the root directory that contains the abstract
statement for this volume.  If there is no copyright file, this
field should contain all spaces (20) Level 1 interchange
restrictions apply.
777 - 813  Bibliographic File Identifier  Identifies the file in the root directory that contains
bibliographic records.  ISO-9660 does not specify the format of
these records.  If there is no copyright file, this field should
contain all spaces (20) Level 1 interchange restrictions apply.
814 - 830  Volume Creation Date and Time  Date and time at which the volume was created.
Represented by seven bytes:
         1: Number of years since 1900
         2: Month of the year from 1 to 12
         3: Day of the Month from 1 to 31
         4: Hour of the day from 0 to 23
         5: Minute of the hour from 0 to 59
         6: second of the minute from 0 to 59
         7: Offset from Greenwich Mean Time in
              number of 15 minute intervals from -48(West) to +52(East)
831 - 847  Volume Modification Date and Time  Date and time at which the volume was last modified.
Represented the same as the Volume Creation Date and Time
848 - 864  Volume Expiration Date and Time  Date and Time at which the information in the volume may be
considered obsolete.  Represented the same as the Volume
Creation Date and Time
865 - 881 Volume Effective Date and Time  Date and Time at which the information in the volume may be
used.  Represented the same as the Volume Creation Date and Time
882 File Structure Version 1
883 Reserved for future standardization (00)
884 - 1395  Application Use  This field is reserved for application use.  Its content is not
specified by ISO-9660.
1396 - 2048  Reserved for future standardization  All bytes must be set to (00).

17 Numbers surrounded by parentheses () are hexadecimal numbers.
18  a-characters are A-Z, 0-9, _, space, !, ", %, &, ', (, ), *, +, ,, -, ., /, :, ;, <, =, >, ?
  see ISO-9660:1988, Annex A, Table 15
19 d-characters are A-Z, 0-9, _
  see ISO-9660:1988, Annex A, Table 14
20 For a description of the level 1 interchange restrictions, see page <?>

Ref: "Introduction to ISO 9660", Disc Manufacturing, Inc., by Clayton Summers
 

No comments:

Post a Comment