CD and DVD Forensics
Walking readers through all facets of handling, examining, and processing CD and DVD evidence for computer forensics, this how-to book provides tools to open CDs and DVDs in an effort to identify evidence of a crime.
TABLE OF CONTENTS CD and DVD Forensics
Chapter 7: Using CD/DVD Inspector
Examining a Disc A Step-by-step Guide
For this chapter, we assume that you have the multi-session disc image file named Exercise1Image.iso (see Appendix B). If you are using CD/DVD Inspector version 3.0 or later, you can directly access this image file. For previous versions, you will have to burn the image to a disc first.
Also for the purpose of this example, we assume that you are looking for images or documents relating to the keyword Bullfrog, which is the codename assigned to a new anti-tank weapons system; however, pictures of frogs can also be significant, possibly containing information hidden using stegonography.
The first step of any CD/DVD Inspector analysis is to create a folder where information about the disc or discs can be stored. It is recommended that you also open Notepad or another text editor, where you can paste information from CD/DVD Inspector during the course of examining a disc.
The following steps describe the process of examining this disc and performing additional keyword searches.
Starting CD/DVD Inspector
Start the CD/DVD Inspector program. When prompted to select a device, insert the disc into any of the devices displayed, wait for the display to change to a green dot in front of that device, and double-click that line. This will start the process of examining the disc and should take less than a minute to complete.
If you have a single CD or DVD device attached to your computer, the default behavior of CD/DVD Inspector is such that if...
Copyright Syngress Publishing, Inc. 2007 under license agreement with Books24x7
