Disc, Disc Images and Hex Editors

vbimport

#1

Hello, I have an audio CD I want to know the date it was burned, I read I can retrieve this information using a hex editor, I’m using trial FlexHex but I can’t seem to open CD’s here. Can anyone help me?
Also, I have no idea what to do then, I read this over a forum, but I don’t know how I go to sector 16, or bytes 814…

Bytes 814-830 of Primary Volume Descriptor indicate the Date/Time. PVD starts at absolute sector 16. You may use any Hex Editor to see the content.
On the same tone, I have recovered a data CD using h2cdimage, it’s IIRC over 60% completed, but yet I can’t open the iso to see my file list at least. I was told to fix the ISO header with a Hex Editor, but I don’t know what to complete there (ISO9660 I guess and whatever it means) nor how. Or probably I need to complete it with some data belonging the the media brand?

well, if anyone’s interested this is my ISO:
400Mb
http://ul.to/k5vqexq4

Thanks!


#2

I downloaded the ISO, but since I know zip about hex editors, I tried a different tack. ISOBuster was able to find the files in the ISO, but would not extract them using the free version of that program. Might work if you had the commercial version.

I also tried ISOPuzzle, but it will not work in my 64bit Windows 7 operating system.


#3

Well, about the ISO I’m more concerned on knowing what was inside rather than extracting (for now at least), so just a file list would be enough for me. I actually reached a point where I know that I will be needing hex editors and such, so there comes the topic title, hope someone can help out.


#4

Also only having the free version of IsoBuster:

00059077 , N/A , 270,00 KB , >:\Recovered File 01.jpg
00059212 , N/A , 210,00 KB , >:\Recovered File 02.jpg
00059317 , N/A , 314,00 KB , >:\Recovered File 03.jpg
00059474 , N/A , 82,00 KB , >:\Recovered File 04.jpg
00059515 , N/A , 350,00 KB , >:\Recovered File 05.jpg
00059690 , N/A , 78,88 MB , >:\Recovered File 06.jpg
00100079 , N/A , 6,49 MB , >:\Recovered File 07.wav
00103400 , N/A , 34,56 MB , >:\Recovered File 08.mp3
00121097 , N/A , 37,85 MB , >:\Recovered File 09.mp3
00140478 , N/A , 60,70 MB , >:\Recovered File 10.mp3
00171557 , N/A , 5,82 MB , >:\Recovered File 11.mp3
00174539 , N/A , 20,08 MB , >:\Recovered File 12.mp3
00184821 , N/A , 2,98 MB , >:\Recovered File 13.mp3
00186347 , N/A , 28,44 MB , >:\Recovered File 14.mp3
00200910 , N/A , 4,84 MB , >:\Recovered File 15.mp3

Not much info, but maybe it helps.


#5

You probably need to recover more with h2cdimage .
Did you use more than one drive with h2cdimage ?
Both h2cdimage & ISOPuzzle can be use in several drives
for recovering the same disc.
You can even move the extraction folder & files to a different computer.
That is what you should try if possible .
Also did you try the .ISO in a virtual drive ?

I tried to DL the file but it was a small .js file instead of an .iso.
I tried twice & then I think I got a limit warning .
Since I don’t speak German I’m not sure.


#6

Here is what I see in ISOBuster:



#7

[QUOTE=cholla;2659060]You probably need to recover more with h2cdimage .
Did you use more than one drive with h2cdimage ?
Both h2cdimage & ISOPuzzle can be use in several drives
for recovering the same disc.
You can even move the extraction folder & files to a different computer.
That is what you should try if possible .
Also did you try the .ISO in a virtual drive ?

I tried to DL the file but it was a small .js file instead of an .iso.
I tried twice & then I think I got a limit warning .
Since I don’t speak German I’m not sure.[/QUOTE]

Yes I know, I used 4 drives for recovery, but when something is unrecoverable, it can’t be helped, whatever is the number of drives used.
With over 60% of ISO recovered it should be able to show file list, because I did some tests recovering a healthy CD and canceling it at 10%, and yet the ISO was openable and could see the file list. So it’s something else, something that has to do with Hex Editors…

Thanks for all the responses and interest but

I actually reached a point where I know that I will be needing hex editors

so I don’t care much about what IsoBuster has to say if it can’t do anything in free mode.


#8

Even if the full version of ISOBuster is not what you plan to use & I don’t know if it would even help.
I tried to download the .iso but all I got was a small .js file.
Since I have a full version of ISOBuster I would have taken a look at it.
I don’t have experence with hex editors either.


#9

The file should be right because other people managed to download, so it must be a problem on the hosting server. If you tell me how to send I can try.
Even so ISObuster is not going to do much, I don’t remember having images there, nor wav… I mean, that file list is pretty random, I can’t only be helped with some HexEditor guidance I think.


#10

[QUOTE=Dogway;2659107]With over 60% of ISO recovered it should be able to show file list…[/QUOTE]As long as the table of contents isn’t intact, unfortunately not :frowning:

P.S.:
Maybe you should upload your ISO to a hoster which allows higher DL speed for free users,
e.g. Zippyshare (needs file splitting though)


#11

I don’t know why it only makes a .js file available & I don’t know if there is an option that would be worth the trouble .
I thought maybe the amount of free downloads allowed to you on the site might be the problem. I don’t know I didn’t check the terms.
I need to update my Opera browser & see if it will work .
IE9 was what I tried.


#12

Ok, I will try to upload after Spain’s match (in 45 min) to mediafire.


#13

[QUOTE=Dogway;2659127]Ok, I will try to upload after Spain’s match (in 45 min) to mediafire.[/QUOTE]

If you see this I got it to start the .iso download in FF .
Opera wouldn’t even try so I think the site didn’t like Opera’s download manager.


#14

[QUOTE=Dogway;2659017]Well, about the ISO I’m more concerned on knowing what was inside rather than extracting (for now at least), so just a file list would be enough for me.[/QUOTE]

The 1st recovered image is pretty good,the rest are damaged images,no benefit to view them.
The names of the other files are next to the image…




#15

I was able to extract about the same as roadworker with ISOBuster pro.
The .mp3s & .wav are corrupt in that they have skips in them.

I identified some of the songs with Tuneatic.
Some were in Spanish .
Found a date on one file with the HEX feature of Irfanview.
This is the other good image:

Limp Bizkit Take A Look Around(Theme From “M:I-2”) 2000
I disappear Metalica
Bongo Bong Manu Chao
Encoder Gogo
Cada Vez Negrocan;
Craig David Seven Days
The Prodigy - Mindfields
Eagle Eye Cherry - Are You Still Having
AGFiesta (House |
Party) (Radio) |
DJ Mendez |
Le|
nnart @ Mp3 Fort|
ress 2000|
www.mp3fortress2|
000.tsx.org V.|

Hope this helps . I would say the date is 2000 on the files.



#16

so cool… that’s actually impressive. I’m very grateful for all the interest and help.
I hoped to learn to fix and find out things on Hex anyways, if it’s possible. More about learning… ATM I’m uploading the ISO to mediafire in 2 parts. I have more ISO’s I want to at least try to fix so I’m able to retrieve the file list. It’s always sad when you lose things.


#17

[QUOTE=Dogway;2659154]
I hoped to learn to fix [/QUOTE]

Not possible with damaged files without recovery blocks,like for example *.par files…
The image is damaged,and you only can (partially) view or extract it’s contents…not even the best hex editor in the world can help you to repair the file…


#18

What I find SO STRANGE is that 60% of 400Mb is quite a bunch of useful recoverable data, yet you only managed to get a few Mb… that makes me wonders that something else could be done.
Or is it as simple as, destroy the table of contents, and you will never be able to extract anything (despite the left 90% of data being theoretically OK)?
These are a few posts that encouraged me to take this Hex Editing route:



this is the iso in 2 parts mediafire:
part 1 part 2


#19

Going back to your initial question on the Audio CD, there’s no file system on such discs and therefore no PVD to read any date from.

Not only that, it would only contain the date the file system was created, not when the disc was burnt. You could make it one year and burn it the next… it would still just contain the date of when you made it.

If it wasn’t an Audio CD you’d have to work out the sector size of the image in question and then jump forward (16 * SectorSize) bytes in your hex editor, before then jumping an additional 814 bytes to get to the time/date field (that’s based on the info you provided, I haven’t checked it). Basically, the sector you’re looking for would have a CD001 at the start of it (assuming it uses the ISO9660 file system) - so if you end up on that after your initial jump, you’re in the right place :slight_smile:


#20

oh LIGHTNING UK! Sorry to bother, I didn’t mean to.
On the wiki it says sector size is rarely anything different than 2KiB
Would I be (likely) safe to attach to it? or is there anything else I can do to find the sector size? (I realised that h2cdimage shows the sector size!)

That makes 16*(2048bytes) = 32768, that’s where I should jump to? and then scrub 814 bytes more…

GOOD, I didn’t have a healthy CD iso at hand, so I ripped one and just found it:

2002081616101300$2002081616101300$0000000000000000

16-August-2002? This is strange because I know the cd (and photos) are from 2007. The only reason being that the Photograph Shop computer had the date wrong… : /

Anyway since studying with a healthy ISO is much better than a destroyed one…
I found a bit lower in byte 36883 the information that seems to be the file list of the disc, it contains actually all the folder names. The file names seem to be more spread later on…

Well, although it seems not your little post helped me a lot to at least understand and manage hex editors!
So thanks a bunch.