An update on this. After looking at this on and off for the past few weeks, and studying the .iso more, I think I’ve discovered a few things.
One, this .iso was made using the “Hard Drive Emulation” mode. Even though the data comes to about 80mb, the image itself is 250mb. So it’s possible a image was made from a 250mb hard drive partition that contained only 80mb of data.
The disk was burnt using Nero. The reason I cannot see any of the data inside Windows is because it’s all contained within the boot loader itself. Normally you would use Floppy Emulation that can use 1.44MB or 2.88MB image sizes, but since the burn method is Hard Drive Emulation, there is no size restriction.
Thus the data is only visible once the disk boots and loads the hidden image.
Using IsoBuster, I was able to see the boot disc details. It shows the .img size is 2mb, but actually it’s 250mb. IsoBuster simply cannot deal with the image size being bigger and thus takes a guess it’s a 2mb size.
As you can see in the pictures, there’s the boot loader info, and in the second what appears to be a “blank” cd.
I found references to mkisofs and how it can hide the file system when creating an .iso. I thought maybe my image had this done to it, but I don’t think it’s that complicated or as involved. My disc is simply one giant hard drive image, where the data is only visible if the disc itself has been booted of it.
Now that I think I’ve worked it out, the fun is then in how to recreate this effect
What do you guys think?