Is there a way/tool to determine the date and time when a disc has been written/burned with high certainty? This is about data forensics and should be a solid proof. I already tried IsoBuster, but it didn't show me the date/time at which the track has been written.
To find out which, you can execute
on Linux after the disc has been mounted in order to identify the optical disc drive's device file.
Here, the device file is
will display the available file systems. If both are present, analyzing the ISO 9660 one should be easier.
The standard specifies the field Volume Creation Date and Time as a numerical representation of the moment of the volume's creation, written to the 814th through 830th byte of the Primary Volume Descriptor in the following format:
where CC are centiseconds and O is the offset from GMT in 15 minute intervals, stored as an 8-bit integer (two's complement representation).
The first 32 KiB (32,768 bytes) of the disc aren't used by ISO 9660 and the above descriptor immediately follows the unused block, so we're interested 33,582th byte and the 16 that follow.
This information can be analyzed by any tool that can dump/read the raw data on the optical disc. On Linux, you can use dd to dump the relevant part of the image and hexdump to view the last byte properly:
For my Ubuntu 12.04 x64 LiveCD, this gives:
so the image was created on August 23, 2012, at 17:13:47.00 GMT.
The standard specifies the filed RecordingDateandTime as a binary representation of the moment of the primary volume's creation, written to the 376th to 387th byte of the Primary Volume Descriptor in the following format:
Here, each pair is an octet (byte), i.e.,
Again, the first 32 KiB of the disc aren't used by UDF. In addition, the following 32 KiB bytes are reserved for a legacy ISO 9660 file system (which may occupy more space if present).
On a "pure" UDF disc, the command
will display the encoded timestamp.
For testing purposes, I've created an UDF image with K3b. The output of the
Yes, there is:
Checked a minute ago one disk on both W7 and Mac OS X. See screenshots below..