https://secnigma.wordpress.com/2022/05/08/a-guide-to-recovering-damaged-and-rotten-cds/ Skip to content SecNigma Security isn't a destination; it's a perpetual process. Close collapsed * Home * Writeups + Vulnhub + Hack The Box + BugBounty * Tutorials * Contact * About Menu expanded A Starter's guide on recovering damaged and rotten CDs [1] Table of Contents * Prelude * Preventive Measures to Disc Rot * Reading data from a Damaged CD / DVD * The Plan * Creating Disc Image using DVDisaster * Creating Disc Image using DDrescue * Creating Disc Image using TestDisk * Carving files using Photorec * Postlude Prelude TL;DR: {SPOILER ALTERT} I've found a CD! It was just another boring day. The climate was perfect for a lazy day. It rained yesterday and the weather was cool. A chilly breeze was blowing occasionally, reminding me to go and take a nap or to watch a mystery series. But I was kinda burned out to do either of those things. So, I've decided to take a walk around my house. I was walking around my house, bored as hell. I've looked high and low for things that would motivate my mind. Something that would get me out of this boredom. But nothing showed up. Just when I was about to end my strolling, that when I saw something. Something gleaming in the corner of my eye. What is that? I saw some shiny thing, lying on the small puddle, just in front of my house I've walked towards it to get a closer look. Oh! Its just an old CD! Ahh CDs! Remember the time when we used shiny CDs to tranfer games and movies along our friends? What a time it was! After daydreaming about my childhood, I've began to walk into my home. [spider-ver]That's when my spidey senses began tinkling! That's when I've remembered that my old laptop has a CD drive. If I could clean the CD, then probably I could recover some of the data in it! I've went back to the puddle and examined the CD closely. This CD was in pretty bad shape. The metallic layer has been cleared off in many places and the plastic coating had severe scratches in it. Luckily, the CD was relatively new and didn't had any disc rots to it. Even though I knew nothing about it, I've decided to try and recover the data from this damaged disc. This guide to recovering data is based on a damaged disc. But this will probably work on CDs that are affected by disc rot as well. (See? I've used no click bait titles here!) You'll understand why that is, by seeing the picture of the CD I've used. [whatsapp-image-2022-05-08-at-1]Check out this bad boy! [whatsapp-image-2022-05-08-at-1]Look at that no so subtle scratches! [whatsapp-image-2022-05-08-at-1]Oh My God! It even passes light! Ok. Enough with the jokes. Lets get into how we are going to recover the data from the disc. Preventive Measures to Disc Rot Prevention is better than cure. This quote is applicable to data as well. Especially when it comes to storing data. If you are reading this, you probably already learned the hard way that Optical Discs are not so great at storing data for long term. (Except M-Disc and those special Bluray Discs for Archival storage) Well I wasn't aware of what Disc rot is, untill I've actually experienced it. So what should we do? Well, there are three options. 1. Save your data in the Cloud 2. Use Storage mediums meant for Archival 3. Generate and save a copy of ECC of your Disc 1.Amongst these options, the safer option is to store your data in any popular cloud storage. They will have enough backups and redundancy and even though it might be costlier in the long term, the chances for losing your data will be extremely low. 2. The next option is to use storage mediums specifically meant for archival. This includes Magnetic tape drives, M-Discs, Archival grade Bluray discs etc. The main drawbacks for this method is the initial cost and storage. We need to purchase a writer and empty dis(c/k)s to create backups and they don't come cheap. Also, after creating the backup, we need to store it somewhere safe. If storing the backups is not an issue and the initial cost can be justified by your reasons, then this is the best way. 3. The last method is the cheapest method among these. That is, creating and storing the file which contains the Error Correction Code for your disc. We can utilize programs such as dvdisaster to perform this task. Dvdisaster can be used to generate error correction code files for an optical disc, which is in good condition. We should then store this ECC file in a safe place. In the future, if the disc is damaged or deteriorated, we can use the ECC data previously generated by dvdisaster, to recover the damaged parts of the disc. These are all preventive methods, which should be done before the data loss occurs. Now, let's talk about how we can recover data ( or what's left of it) from a damaged CD. Reading data from a Damaged CD / DVD The first problem anyone's with a damaged disc going to encounter, is that they cannot copy files from it using a regular copying mechanism (eg:. file explorer, terminal commands). This is due to the fact that, normal file copying mechanisms will not attempt to read from a bad sector or unreadable data. Instead, they will freeze, or throw an error upon encountering such data. In the case of discrot, we could try the tape method demonstrated here, to increase the chances of recovering the data. This technique does looks promising and it surely is worth trying. To recover data from a damaged medium, we need specialized tools that are aware of this problem and will continue with the reading process, even after encountering errors. Three of such tools are ddrescue , dvdisaster and testdisk. These applications can be used to create an exact image file (or something that resembles it), from a damaged medium. Ok. I have some good news and some bad news. Let's get the bad news out of our way first. Note: Reading from a damaged disc using ddrescue or dvdisaster is going to take a long time. For comparison, from my CD, which has the capacity of 700 MB, there was 400MB of data. And it took around 12 Hours for it to finish reading it! But the good news is that, the process can be cancelled and resumed at any time! [zemo]Wise words from Zemo The Plan You can select either dvdisaster, ddrescue or TestDisk to begin the read process. Once we get an image file, we will carve out the readable data using the photorec utility. Let's start the reading process. I'm going to talk about creating a disk image using the three applications I've mentioned. Although the end goal is same, knowing multiple applications to do the same thing can come in handy. Creating Disc Image using DVDisaster Dvdisaster is a GUI application, so that would be easier to use. It has a nice interface and a cool animation to display progress. On Debian based distros, we can install it using sudo apt install dvdisaster -y [image]Interface of DVDisaster Using DVDisaster is easy. Just select the CD / DVD reader, Specify location to save the output file and Click on start Reading. Once the reading is finished, the file will be stored in the specified location. Creating Disc Image using DDrescue Sometimes, we would need to manually specify some settings when reading a damaged disc; like the block size, reading direction etc. If you want such granular control while reading the disc, then you should go with ddrescue. Also the chances of getting succesful data recovery are higher with ddrescue, since we can use it to run multiple times on the same disc with different read options. On Debian based distros, we can install it using sudo apt install gddrescue -y We are going to run ddrescue three times on the disc. First, we are going to to make ddrescue skip the parts with error and we will read the good data. Then on the second run, we are going to make ddrescue read the entire disc, including the blocks with errors and try to get more data from the disc. And on the final run, we are going to make ddrescue read the entire disc, but backwards. This three step recovery process ensures that we are going to get every last bit of readable information from the damaged disc. Read this answer for a detailed explanation. Note: You can use the info ddrescue command anytime to get a great guide on how to use ddrescue. Read #1 Reading just the Good Data ddrescue -b 2048 -n -v /dev/cdrom dvd.iso rescue.log This command specifies the following things * b : Block Size as 2048 (default blocksize of DVD) * n : No scrape ( Skip the bad sectors) * v : Verbose * /dev/cdrom : The path to mounted CD (This will vary on distros) * dvd.iso : Output image to write * rescue.log : Log file [image-26]Interface of DDrescue. Source: datarecovery.com Note: Now this reading process is going to take a looooong time. Either keep your computer running untill it finishes or just cancel and restart the process with the same command later, to resume the reading process. Read #2 Reading the Bad Data Once it has been finished, we can run it again with scraping (Reading the bad blocks), with the following command. Please note that we are using the same image file (dvd.iso), we've created in the first run and not a different file. ddrescue -b 2048 -d -r 3 -v /dev/cdrom dvd.iso rescue.log Here, we have two new flags. * d : Read the device directly (Instead of going through kernel) * r : Retry count on error Now this is going to attempt to read and recover data from bad sectors. Once new data is found, it will be appended to the dvd.iso image we've created in the first step. Let's continue the waiting game.. [mr-bean-mr] EDIT: The following reverse read is not required as `ddrescue` automatically does this. So skip Read #3 and go straight to the next step. Thanks to LinAGKar for pointing out my mistake. Read #3 Reading the Bad Data, But in Reverse Once that command has finished it's execution, let's scrape again, but this time in a reverse order. ddrescue -b 2048 -d -R -r 3 -v /dev/cdrom dvd.iso rescue.log * R : Reverse read After this command finishes execution, we will have an image file with the data recovered by ddrescue. Now if we check the file type of the extracted image, we can see that it's not a proper ISO file. Instead, it's recognized as a data file. [image-2] This means that we have to perform additional carving in the recovered image, to get usable files from it. Creating Disc Image using TestDisk Now as the final method for creating a disc image file, I'm going to use Testdisk. TestDisk is a free and open source tool, that helps users recover lost partitions or repair corrupted filesystems. Testdisk is actually faster in creating disc images, in comaprison to other disc imaging methods. PhotoRec is a free and open-source tool for data recovery using data carving techniques, designed to recover lost files. We will first use TestDisk to create a disc image from the CD. Then, we could use PhotoRec on the disc image to carve files from it. To install TestDisk and Photorec on debian based distros, use sudo apt install testdisk -y Photorec is a part of testdisk suite. So, It will be automatically installed along with testdisk. To use testdisk, simply pass the full path to my CD, as an argument to it. In my case, it is /dev/cdrom. testdisk /dev/cdrom Select Proceed and press enter when TestDisk prompts to select Media. [image-14] Now, choose Continue, when prompted to continue. [image-15] Select None when TestDisk asks for partition table type. [image-16] Now press Right Arrow to highlight the Image Creation at the bottom and Press Enter. [image-17] Select the directory to save the output disk image. If you want to save it to the current working directory, just press "C" to confirm. [image-9] [image-18]TestDisk Creating Disk Image Once TestDisk finishes creating the image file, we can choose to perform additional operations on it, or just exit. [image-11] Here, I am quitting TestDisk. Now, we will have an image file named image.dd. Now, let's start the carving process. Carving files using Photorec To start the file carving process, we are going to use the tool photorec. If you've installed testdisk, photorec will be automatically installed along with it. We can now run photorec on any of the disc images we've generated earlier to start the carving process. photorec image.dd Photorec's interface is similar to TestDisks. [image-19] Select Proceed and press Enter. You can now select Search to start the File recovery. [image-20] OR you could choose specific file formats to recover from the File Opt menu. [image-21]File Opt Menu After selecting Search, photorec will prompt you to choose the file system type. Choose Other and press enter. [image-22] Now, PhotoRec will ask us to select a location to save the recovered files. Select the location and press "C" to confirm. [image-23] [image-24]PhotoRec carving files Once the process has been finished, we can find the files inside a directory called recup_dir.* Here's a list of recovered files from my CD. [image-25] Around 30-40% of the files are recovered fully, others were recovered partially and some files have been split into multiple files. Though it might not seem like a great number, considering the stage the disc was in, it is indeed a great achievement achieved through pure software trickery! I'm sure that I could've gotten more data, if I've spent some time on physically polishing the CD's surface using common household items or even using specialized tools like disc resurfacer to reduce the scratches. But, since this was just a hobby project, I'm more than satisfied with the outcome. Postlude And that's it. That's how we recover data or what's left of it from damaged CDs. Though it might take a looooong time for the process to complete, if you have patience and some passion, you'll get a good amount of data recovered. I hope this little post help my future readers to recover their precious data. Also, massive thanks to Digitalferret, pdo and petri-drg for their advices in this matter. Peace out! [?] Share this: * Twitter * Facebook * Like Loading... Related Posted bysecnigmaMay 8, 2022July 26, 2022Posted ininformation security, TutorialsTags:cd, damaged, ddrescuegddrescue, dfir, digital forensics, disc rot, dvd, dvdisaster, forensics, linux, recoverphotorec, testdisk, Ubuntu [46a85] Published by secnigma View all posts by secnigma Post navigation Previous Post Previous post: Hack The Box: Unicode Next Post Next post: Hack The Box: Pandora 6 Comments 1. Pingback: Week 20 - 2022 - This Week In 4n6 2. [a3cc] pavde says: March 14, 2023 at 5:05 pm 1. Optical Discs are the best at storing data for long term. 2. Don't save your data in the Cloud. Cloud storage is the worst. 3. Don't use magnetic tape. It's pointless. 4. You should have to mention that optical discs should be stored in standard (not slim) jewel cases. 5. Burn/write to optical disc at slow speed. 6. Don't stress/torture the optical disc drive. Reading from a damaged disc for hours will damage the optical drive. 7. You can use WinRAR with recovery record to store your files. (I would use Store compression method.) LikeLiked by 1 person Reply 1. [46a8] secnigma says: March 31, 2023 at 5:25 pm Hello pavde, I agree with most of your points, but I have some difference of opinion with some of your takes. 1. Yes, I agree. Normal optical discs aren't a reliable medium for long term storage. However, there are some archival grade mdiscs that are reliable as a long term solution and it's miles better than usual optical discs. 2. If cloud storage is just a redundant backup medium and we do posses an actual physical copy of the data, then I don't see a problem with cloud storage at all. 3. If the backup quantity is large enough to justify the initial investment, then I don't see a problem with magnetic tapes either. I'd like to hear about your opinion on why cloud and magnet tapes are bad/pointless . 4. I agree. How the disc is stored is also a crucial factor when it comes to longevity of the storage medium. 5. I agree. 6. The chance of a bad disc causing harm to the disc reader is close to none or highly unlikely. Unless the disc is really dirty (oil, grease, debris in the disc), the scratched /rotten disc shouldn't cause any harm to the Disc reader. 7. I agree. Writing recovery bits along with the data would be the best method when writing important data into CDs. LikeLike Reply 1. [a3cc] Parve says: April 26, 2023 at 10:48 pm 1. Even normal optical discs are also among the best and most reliable mediums for long term storage, but only if you do the 4. and 5. points I mentioned (store them in standard jewel cases and write to them at slow speed). Yes, MDISC is the absolute best. Inorganic BluRay too. All my 15-20 years old burned CDs and DVDs work perfectly. I'm burning discs since I was a child in the early 2000s. 2. Problems with cloud storage: It's just someone else's computer. It costs money, it requires internet access, cloud storage providers scan your data so there is no privacy, the service can shutdown anytime, they can delete your data anytime, the service can change their policy anytime and hold your data as a hostage (like Photobucket did), hackers (or the service employers, government) can access your data, ... 3. Problems with magnetic tape: The drives are overpriced, hard to find, not futureproof (magnetic tapes are not widespread, so in the future you won't be able to buy drives to read the content), even now I can't find any webshop in my country that sells tape drive, the tape does not have better lifespan than other storage, it's slower and harder to find, read and write data from/to the tape, it has questionable read/ write cycles, the tape drive has questionable lifespan, it requires maintaining, ... The use case of magnetic tapes is when you want to store excessive amount of data. 6. I remember I read that stressing an optical disc drive damages it, but I hope it's not true. I can't confirm it because it never happened to me. My old drives still work perfectly. 8. A catalog software is also useful (for example WhereIsIt), so you can find/look through all files on all discs without having to insert them into the disc drive. It's also good for pendrives and external HDDs. 9. Use a permanent marker with water-based ink and soft nib to write on the optical discs (for example: edding 8400). In the past I always used alcohol based markers and never had a problem, but since I read that water-based ink should be used with optical discs, I switched to them. LikeLiked by 1 person 3. [a3cc] Parve says: March 15, 2023 at 6:33 pm So you deleted my comment? LikeLike Reply 1. [46a8] secnigma says: March 31, 2023 at 4:29 pm Hi Parve, To prevent spammers, I have enabled comment approval in my blog. So, your previous comment wasn't deleted per se. Your comment was waiting for my approval and it wasn't approved till today. (I actually forgot to check my notifications) LikeLike Reply Leave a Comment Cancel reply [ ] [ ] [ ] [ ] [ ] [ ] [ ] D[ ] Site Navigation * Home * Writeups + Vulnhub + Hack The Box + BugBounty * Tutorials * Contact * About * Home * Writeups * Tutorials * Contact * About SecNigma, Blog at WordPress.com. [Close and accept] Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use. To find out more, including how to control cookies, see here: Cookie Policy * Comment * Reblog * Subscribe Subscribed + [croppe] SecNigma [ ] Sign me up + Already have a WordPress.com account? Log in now. * + [croppe] SecNigma + Customize + Subscribe Subscribed + Sign up + Log in + Copy shortlink + Report this content + View post in Reader + Manage subscriptions + Collapse this bar Loading Comments... Write a Comment... [ ] Email (Required) [ ] Name (Required) [ ] Website [ ] [Post Comment] %d [b] Design a site like this with WordPress.com Get started