CD and DVD Forensics
Walking readers through all facets of handling, examining, and processing CD and DVD evidence for computer forensics, this how-to book provides tools to open CDs and DVDs in an effort to identify evidence of a crime.
TABLE OF CONTENTS CD and DVD Forensics
Chapter 5: Preparing for Disc Examination
In order to conduct an examination of the digital evidence on Compact Disc (CD) or Digital Versatile Disc (DVD) media, you must have the proper hardware, software, and workstation.
Forensic Hardware
Overview
It is recommended that you have two separate devices: a reliable Compact Disc - ReWritable (CD-RW) drive and a recent DVD writer that can read both DVD+ and DVD media. Recent writers should also be compatible with Digital Versatile Disc Plus Recordable (DVD+R) DL (dual layer) media.
While it may seem counterintuitive, you must use a writer-type device, because reader devices do not access open sessions on discs. This means that any incomplete drag-and-drop discs would not be accessible with a reader. Worse still, a multi-session disc that has been closed at least once and written to again with drag-and-drop writing software, will only show the finalized content; anything added after that would be invisible.
It is not necessary to use a write-blocker device with a CD or DVD writer, because writing software that functions without prompting is not present in Microsoft Windows. Before it will write to a disc, the CD writing capability present in Windows XP requires considerable effort on the part of the user. This writing capability also does not utilize rewritable media, such as CD-RW discs, making it difficult to write to a CD or DVD without significant user interaction.
If necessary, you can disable the Windows XP CD writing capability by opening the My Computer window and right-clicking the drive to be changed.
Copyright Syngress Publishing, Inc. 2007 under license agreement with Books24x7
