2

If a file is saved using Microsoft word or some other type of program, you can right click on the file to find the properties, which will indicate the computer that created the file.

Is there anyway to find out who created an ISO disk image on a CD or DVD? I assume that there should be no meta data on the disk because an ISO disk image should be an exact duplicate of the original. Is my assumption correct?

To illustrate with an example, let's say you found a CD at a cafe or something. You decide to look at the CD with your computer. You find out that it is an "Ubuntu live CD" that was obviously created from an ISO file. Is there any way to find out who burned the CD? Or, on the flip side, let's say you were the one that burned the "Ubuntu live CD" and you lost it. Would somebody be able to know that it was you who made the CD? Can they get any info about the maker?

5
  • 3
    No, there's no extra metadata on it. Sep 24, 2012 at 19:52
  • 1
    It was most likely burned by someone who wrote a bios trojan or virus to your eeprom shortly before you figured out it was a "ubuntu live CD"
    – Gung Foo
    Sep 24, 2012 at 19:58
  • @gung foo. wtf ?
    – Sirex
    Sep 24, 2012 at 20:58
  • @Sirex The picking up random stuff lying around method is a common vector for virus infection. A security company recently left infected flash drives lying around an office space to test this out, and a surprising number of people picked them up and plugged them in to their workstations.
    – NReilingh
    Sep 24, 2012 at 21:37
  • Yeah, sure, but "most likely" ? I'd have thought most likely is 'someone forgot their cd', seconded by 'someone messed up burning a cd', ...distant thirded by 'vigilante linux mafia gorilla physops warfare'
    – Sirex
    Sep 24, 2012 at 21:43

2 Answers 2

2

No. An ISO file contains all the information that goes on the disk. Two disks produced from identical files will read the same data back. Special procedures can enable the addition of more information to the disk, usually to artificially increase the complexity of manufacture, but that (at the very least) requires additional hardware and someone doing it on purpose.

Occasionally someone claims all/most/some disk writing devices add their serial number & c. weakly embedded in the data stream/between sectors/in subchannels, for the benefit of law (or any other) enforcement. Most people don't believe them. It has however been shown that some printers (for paper) print their numbers very faintly in yellow toner, so it might not be as far out as one would like.

2
  • You'd think from the fact law enforcement has never ever once used this secret hidden track data in a conviction, perhaps people would conclude that's because it's entirely fictional ? Ugh.
    – Sirex
    Sep 24, 2012 at 21:35
  • @Sirex I refuse to take a side on the issue, but one might choose to believe that they are waiting for a big fish on the assumption that the trick will work better the first time. There's also the bit about illegal surveillance being less problematic early in an investigation than in a court room.
    – Eroen
    Sep 24, 2012 at 21:44
2

ISO disc images can contain metadata such as Volume Label, System Identifier, Volume Set, Publisher, Data Preparer, Application and so on:

ISO Properties in MagicISO

These persist even when the image is burnt to disc. I just ran isoinfo for Windows on one of my discs, and it displayed all the info. I had set prior to burning, in the following format (actual details deleted):

CD-ROM is in ISO 9660 format
System id:
Volume id:
Volume set id:
Publisher id:
Data preparer id:
Application id:
Copyright File id:
Abstract File id:
Bibliographic File id:
Volume set size is:
Volume set sequence number is:

It's not going to happen automatically, but I suppose if someone bothers to include those details (such as their name, address etc. in the Data preparer field), anyone with the right tools can access them from the disc.

1
  • To emphasise your point and avoid confusion; these properties are all set in the ISO image, by whoever prepares that, so they can not be used to identify who created the disk.
    – Eroen
    Sep 25, 2012 at 8:06

You must log in to answer this question.