Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 14 down vote favorite
1

A friend of mine made a personal data CD. Days later he found a copy elsewhere.

He wants to prove the copy didn't come from his computer, but that someone took the CD and copied it from another computer. Can it be done?

share|improve this question

2 Answers

up vote 8 down vote accepted

According to Microsoft (via here), CD burners can leave a digital fingerprint of sorts. What's necessary to detect and compare them, or whether it's within the reach with consumer technology I don't know though.

share|improve this answer
Thanks, this is precisely what we need. I'll keep the question unanswered a bit more to see if someone mentions software capable of reading the RID or SID of a CD/DVD. – ASalazar Jan 11 '12 at 20:25
1  
Looks like this forum thread shows where to read it. You'll need to write or use some low-level drive access tools to get at it. – pdubs Jan 11 '12 at 20:31
I'm marking this reply as an answer because it's closer to what I need. Thanks both for your help. – ASalazar Jan 12 '12 at 22:36
up vote 5 down vote

Some interesting thoughts:

http://hackingexposedcomputerforensicsblog.blogspot.com/

From the software, you can determine what software made the CD, when the CD was burned (probably the most useful), and other various things.

share|improve this answer
2  
I'd like to add that I don't think that would be definitive, usable in court evidence for 100% determining whether or not it was burned from the same machine. If someone WANTED to make it look like it was from the same machine, it seems trivial to accomplish (change system time, use the same software) but it sounds like more trouble than is worth for this sort of thing. – Jeff Jan 11 '12 at 18:11
I don't think he'll carry it to court, but even if he did, this would be strong evidence. – ASalazar Jan 11 '12 at 20:21
I would call it secondary, would you agree? I think it can reasonably point the finger at him, but at the same time, could it not be faked? On the point made above, I've been looking for the software you were looking for, I can't find it. I'll scrounge around some more... – Jeff Jan 12 '12 at 14:17
The only thing I could find off the bat was something called CD/DVD Inspector. It promises to support "Low-level sector exam and scanning." www.infinadyne.com/cddvd_inspector.html Can't vouche for it, never used it. – Jeff Jan 12 '12 at 14:29
Thank you, Jeff. I found that too, but at $649 it was a bit overkill =/ – ASalazar Jan 12 '12 at 22:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.