Read TOC for number of tracks, then Read Track Info for size and start address of track. RID Code located at LBA address: session_last_address + 1. High order 3 bits of mode byte of this sector is 111b (for mode 1 - mode byte E1 instead of 01).
Also RID code located at LBA addresses:
session_first address - 150 (Link block)
session_first address - 149 (Run-in block 1)
session_first address - 148 (Run-in block 2)
session_first address - 147 (Run-in block 3)
session_first address - 146 (Run-in block 4)
No Link blocks - no RID code. (RID code appear only in incrimental writing)
On some drives RID Code unaccessable. If you will success in reading RID Code please tell me your drive model. Btw, on all NECs in my disposal RID code accessable.
Various interesting things. If you read sector containing NEC RID code you can see drive serial number. If you can access serial number you can identify recorder.
P.S. Maybe you know how to convert sector read time to read speed?
P.P.S. And, as usual, sorry for my bad english