CDRW

CD layout

A CD is composed of several zones

• PCA (Power Calibration Area)
• PMA (Program Memory Area)
• one or more sessions

The SUA (System User Area) is composed of PCA and PMA.

Each session consists of

• a Lead-In Area, containing the session's Table of Contents (TOC),
• the Program Area in which the individual tracks are located,
• and the Lead-Out Area.

A track is composed of

• a pre-gap zone
• audio/user data area
• a pad zone

Each block or sector has an header - the block location is stored in each header.

Recovery of a scratched CD-R/CD-RW/DVD

Photorec works well but bad sectors slows the recovery process.

Recovery of a fast blanked CD-RW

It's possible to recover data from a quick-erased CD-RW disc without modifying it!

When a CD-RW is fast erased, the PMA, TOC, pregap and the first sectors of your CD-RW are erased. Because the TOC has been erased, CD-RW appears as blank/empty. Because the first sectors have been erased including the headers, sectors 0, 1, 2... can't be located anymore but subsequent sectors can still be found. Unfortunatly, not every OS allows you to easily access these sector but it works using Linux.

To recover your lost data, run Linux version of Photorec. If CD-RW listed size is 0 or 2048 bytes, the CD-ROM reader firmware will block further read request. You'll have to use another CD-ROM reader/writer. Start of the recovery is really slow because the first sectors are unreadable. Usually after sector 300 data can be recovered, so be patient.

Read of previous CD-ROM session

With a multi-session CD-ROM, it is possible to recover files from previous sessions. Because the files are not really deleted, it is possible to recover them. To read files from the first session, run under Linux

mount /dev/cdrom /mnt/cdrom -t iso9660 -o session=0

Deleted files recovery from a floppy

Recover deleted files using PhotoRec

• Run cmd.exe
• Use the cd to change directory to photorec_win.exe location

cd testdisk-6.10\win

• Run PhotoRec

photorec_win.exe \\.\a:

Be careful, the only space is after photorec_win.exe

• Choose None for the partition table type.
• More details about the next steps can be found in PhotoRec Step By Step

Recover deleted files from FAT using TestDisk

If the floppy is using a FAT filesystem and the filesystem is not corrupted, it's also possible to use TestDisk 6.10 or later to recover the data including the original filenames.

• Run cmd.exe
• Use the cd to change directory to testdisk_win.exe location

cd testdisk-6.10\win

• Run TestDisk

testdisk_win.exe \\.\a:

Be careful, the only space is after testdisk_win.exe

• Choose None for the partition table type.
• Select Advanced
• Select Boot
• If the FAT boot sector is intact, you should be able to select List
• Navigate the floppy directories - deleted files and directories are displayed in red
• Use c to copy the deleted files to a local folder.

Return to TestDisk

Retrieved from "https://www.cgsecurity.org/mw/index.php?title=CDRW&oldid=5680"