CDRW

From CGSecurity

Jump to: navigation, search

en.png english version de.png deutsche Version es.png versión español fr.png version française ru.png Русская версия


Contents

CD layout

A CD is composed of several zones

  • PCA (Power Calibration Area)
  • PMA (Program Memory Area)
  • one or more sessions

The SUA (System User Area) is composed of PCA and PMA.

Each session consists of

  • a Lead-In Area, containing the session's Table of Contents (TOC),
  • the Program Area in which the individual tracks are located,
  • and the Lead-Out Area.

A track is composed of

  • a pre-gap zone
  • audio/user data area
  • a pad zone

Each block or sector have an header, the block location is stored in each header.

Recovery of scratched CD-R/CR-RW/DVD

Photorec works well but bad sectors slows the recovery process.

Recovery of fast blanked CD-RW

It's possible to recover data from a quick-erased CD-RW disc without modifying it!

When a CD-RW is fast erased, the PMA, TOC, pregap and the first sectors of your CD-RW are erased. Because the TOC has been erased, CD-RW appears as blank/empty. Because the first sectors has been erased including the headers, sectors 0, 1, 2... can't be located anymore but subsequent sectors can still be found. Unfortunatly, not each OS allows you to easilly access such sector but it works using Linux.

To recover your lost data, run Linux version of Photorec. If CD-RW listed size is 0 or 2048 bytes, the CDROM reader firmware will block further read request, so you have to use another CDROM reader/writer. Start of the recovery is really slow because the first sectors are unreadable but usually after sector 300, data can be recovered, so be patient.

Read of previous cdrom session

With multi-session cdrom, it is possible to delete files of previous session. Because the files are not really deleted, it is possible to recover them. To read files from the first session, run under Linux

mount /dev/cdrom /mnt/cdrom -t iso9660  -o session=0

Deleted files recovery from a floppy

Recover deleted files using PhotoRec

  • Run cmd.exe
  • Use the cd to change directory to photorec_win.exe location
cd testdisk-6.10\win
  • Run PhotoRec
photorec_win.exe \\.\a:

Be careful, the only space is after photorec_win.exe

  • Choose None for the partition table type.
  • More details about the next steps can be found in PhotoRec Step By Step

Recover deleted files from FAT using TestDisk

If the floppy is using a FAT filesystem and the filesystem is not corrupted, it's also possible to use TestDisk 6.10 or later to recover the data including the original filenames:

  • Run cmd.exe
  • Use the cd to change directory to testdisk_win.exe location
cd testdisk-6.10\win
  • Run TestDisk
testdisk_win.exe \\.\a:

Be careful, the only space is after testdisk_win.exe

  • Choose None for the partition table type.
  • Select Advanced
  • Select Boot
  • If the FAT boot sector is intact, you should be able to select List
  • Navigate in the floppy directories, deleted files and directories are displayed in red
  • Use c to copy the deleted files to a local folder.

Return to TestDisk

Data Recovery
Security