# CDRW

### From CGSecurity

english version deutsche Version versión español version française

## CD layout

A CD is composed of several zones

- PCA (Power Calibration Area)
- PMA (Program Memory Area)
- one or more sessions

The SUA (System User Area) is composed of PCA and PMA.

Each session consists of

- a Lead-In Area, containing the session's Table of Contents (TOC),
- the Program Area in which the individual tracks are located,
- and the Lead-Out Area.

A track is composed of

- a pre-gap zone
- audio/user data area
- a pad zone

Each block or sector have an header, the block location is stored in each header.

## Recovery of scratched CD-R/CR-RW/DVD

Photorec works well but bad sectors slows the recovery process.

## Recovery of fast blanked CD-RW

It's possible to recover data from a quick-erased CD-RW disc without modifying it!

When a CD-RW is fast erased, the PMA, TOC, pregap and the first sectors of your CD-RW are erased. Because the TOC has been erased, CD-RW appears as blank/empty. Because the first sectors has been erased including the headers, sectors 0, 1, 2... can't be located anymore but subsequent sectors can still be found. Unfortunatly, not each OS allows you to easilly access such sector but it works using Linux.

To recover your lost data, run Linux version of Photorec. If CD-RW listed size is 0 or 2048 bytes, the CDROM reader firmware will block further read request, so you have to use another CDROM reader/writer. Start of the recovery is really slow because the first sectors are unreadable but usually after sector 300, data can be recovered, so be patient.

## Read of previous cdrom session

With multi-session cdrom, it is possible to delete files of previous session. Because the files are not really deleted, it is possible to recover them. To read files from the first session, run under Linux

    mount /dev/cdrom /mnt/cdrom -t iso9660  -o session=0

## Deleted files recovery from a floppy

### Recover deleted files using PhotoRec

- Run `cmd.exe`
- Use the `cd` to change directory to photorec_win.exe location

    cd testdisk-6.10\win

- Run PhotoRec

    photorec_win.exe \\.\a:

Be careful, the only space is after `photorec_win.exe`

- Choose `None` for the partition table type.
- More details about the next steps can be found in PhotoRec Step By Step

### Recover deleted files from FAT using TestDisk

If the floppy is using a FAT filesystem and not the filesystem is not corrupted, it's also possible to use TestDisk 6.10 or later to recover the data including the original filenames:

- Run `cmd.exe`
- Use the `cd` to change directory to testdisk_win.exe location

    cd testdisk-6.10\win

- Run TestDisk

    testdisk_win.exe \\.\a:

Be careful, the only space is after `photorec_win.exe`

- Choose `None` for the partition table type.
- Select `Advanced`
- Select `Boot`
- If the FAT boot sector is intact, you should be able to select `List`
- Navigate in the floppy directories, deleted files and directories are displayed in red
- Use `c` to copy the deleted files to a local folder.

Return to TestDisk

Category: Data Recovery

##### Data Recovery

- TestDisk
- PhotoRec
- download