CD Writer filtering

Hi all!

I have written the FS filter driver, which can see all the read/write
accesses to the disk/CD and associate them with the file name.

Now I have the following issue: most of the CD writer burning programs don’t
write through the file system.

Is there any idea how I can know the written files’ names in this case.

Thanks,

Dany

Quoting Dani Polovets :

> Hi all!
>
> I have written the FS filter driver, which can see all the read/write
> accesses to the disk/CD and associate them with the file name.
>
> Now I have the following issue: most of the CD writer burning programs don’t
> write through the file system.
>

Most CD writer create an image of cd in user mode and write the contents of the
image data and file system in one go. Excepting Packet CD individual files are
not being written.

> Is there any idea how I can know the written files’ names in this case.

Most CD Writer programs write in one of several ways.
eg; Scsi Pass Through, Helper driver in cdrom storage stack. Helper driver
(Aspi) in Scsi/Ide controller stack.

All these can be filtered.

The final method used. Is a helper driver calls the port driver directly. These
can not be filtered legitimately. Inconsiderate driver writers could hook the
port driver. Very bad.

Once you can see the scsi requests you can with a good knowledge of ISO9660 or
UDF reconstruct the file system and work out what is being written and where,
Most CD image creators place the directory structure before the data. Although
that is not a requirement. This is a non trivial task.

A storage filter driver(or a bus filter driver) + analyse of CDFS/UDF

Regards,
ZG [@ Sydney]
Windows Driver Developer

“Dani Polovets” wrote in message news:xxxxx@ntfsd…
Hi all!

I have written the FS filter driver, which can see all the read/write accesses to the disk/CD and associate them with the file name.

Now I have the following issue: most of the CD writer burning programs don’t write through the file system.

Is there any idea how I can know the written files’ names in this case.

Thanks,

Dany

Thanks for an answer.
Can you recommend an open source (if any) for ISO9660/UDF analyzing.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of ian blake
Sent: ? 12 ??? 2005 12:03
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] CD Writer filtering

Quoting Dani Polovets :

> Hi all!
>
> I have written the FS filter driver, which can see all the read/write
> accesses to the disk/CD and associate them with the file name.
>
> Now I have the following issue: most of the CD writer burning programs
don’t
> write through the file system.
>

Most CD writer create an image of cd in user mode and write the contents of
the
image data and file system in one go. Excepting Packet CD individual files
are
not being written.

> Is there any idea how I can know the written files’ names in this case.

Most CD Writer programs write in one of several ways.
eg; Scsi Pass Through, Helper driver in cdrom storage stack. Helper driver
(Aspi) in Scsi/Ide controller stack.

All these can be filtered.

The final method used. Is a helper driver calls the port driver directly.
These
can not be filtered legitimately. Inconsiderate driver writers could hook
the
port driver. Very bad.

Once you can see the scsi requests you can with a good knowledge of ISO9660
or
UDF reconstruct the file system and work out what is being written and
where,
Most CD image creators place the directory structure before the data.
Although
that is not a requirement. This is a non trivial task.


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@safend.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Filter all SCSI WRITEx requests, assemble the ISO image in the filter,
parse its CDFS/UDF structure, then get the filenames.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Dani Polovets”
To: “Windows File Systems Devs Interest List”
Sent: Monday, December 12, 2005 12:05 PM
Subject: [ntfsd] CD Writer filtering

> Hi all!
>
> I have written the FS filter driver, which can see all the read/write
> accesses to the disk/CD and associate them with the file name.
>
> Now I have the following issue: most of the CD writer burning programs don’t
> write through the file system.
>
> Is there any idea how I can know the written files’ names in this case.
>
> Thanks,
>
> Dany
>
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

> The final method used. Is a helper driver calls the port driver directly.
These

can not be filtered legitimately

We can throw away the hooker’s functions from the port dispatch table, or even
disable the hooker from the registry.

After this, we can document that “our product breaks the functionality of the
other products A, B, C, due to them using non-legitimate methods of hardware
access”.

For security software whose purpose is to restrict access, this is OK.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

>Can you recommend an open source (if any) for ISO9660/UDF analyzing.

“mkisofs” contains the UDF and CDFS generation code.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

Thanks for the answers.
I have some additional questions:

  1. In most cases I saw, the writes to the CD are consecutive (besides
    Alcohol, which is writing to the end of the CD first and then pass to the
    beginning). Is it possible to write to the CD in non-consecutive order?

  2. The buffer size in the scsi command depends on the burning application.
    How can I know the write mode (write logical sector size)? Should I treat
    the start address in the scsi command as 512 * N bytes or a CD logical block
    number * N?

  3. ISO primary volume descriptor is located on the logical sector #16.
    I suppose the logical sector size is written on the CD. Where can I find it?

Thanks,
Dani

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of ian blake
Sent: ? 12 ??? 2005 12:03
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] CD Writer filtering

Quoting Dani Polovets :

> Hi all!
>
> I have written the FS filter driver, which can see all the read/write
> accesses to the disk/CD and associate them with the file name.
>
> Now I have the following issue: most of the CD writer burning programs
don’t
> write through the file system.
>

Most CD writer create an image of cd in user mode and write the contents of
the
image data and file system in one go. Excepting Packet CD individual files
are
not being written.

> Is there any idea how I can know the written files’ names in this case.

Most CD Writer programs write in one of several ways.
eg; Scsi Pass Through, Helper driver in cdrom storage stack. Helper driver
(Aspi) in Scsi/Ide controller stack.

All these can be filtered.

The final method used. Is a helper driver calls the port driver directly.
These
can not be filtered legitimately. Inconsiderate driver writers could hook
the
port driver. Very bad.

Once you can see the scsi requests you can with a good knowledge of ISO9660
or
UDF reconstruct the file system and work out what is being written and
where,
Most CD image creators place the directory structure before the data.
Although
that is not a requirement. This is a non trivial task.


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@safend.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

>1. In most cases I saw, the writes to the CD are consecutive (besides

Alcohol, which is writing to the end of the CD first and then pass to the
beginning). Is it possible to write to the CD in non-consecutive order?

With packet writing only. If Alcohol uses packet writing for stupid ISO image
burning - then this is a good idea to never ever use such a “smart” app.

  1. The buffer size in the scsi command depends on the burning application.
    How can I know the write mode (write logical sector size)?

You must monitor MODE SELECT commands to WRITE PARAMETERS mode page to get the
knowledge about the sector size for this session, be it 2352 bytes or 2048
bytes.

  1. ISO primary volume descriptor is located on the logical sector #16.
    I suppose the logical sector size is written on the CD. Where can I find it?

ISO filesystem always uses 2048 bytes per sector. The sector size depends not
upon the disc structure, but upon the way of interpreting the disc sectors.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

  1. Well… This is simply not true :slight_smile: What you think is the end of the disc
    is actually a negative LBA. It could be a surprise
    for you but CDs recorded in SAO or DAO mode could start from -35634 or -150
    for example. Then LBA goes to zero and
    only then start to have 16 or say 30 blocks per write increments. So it may
    look like the writing goes to the end of the
    disc and then turns back to the beginning of it. But it’s only a “minus”
    sign bit :slight_smile: It’s PERFECTLY OK for any app to burn
    ISO image in DAO or SAO mode. That’s for CDs.

It may also be a surprise for you but some of the multisession DVD-RWs
(restricted overwrite), all of the DVD+RWs and
DVD-RAMs could be recorded at random LBA. Just like hard disks. So when
multisession disc is recorded it always happens
new session is recored starting from say 10,000 LBA, user data goes there
and only then original PVD (for ISO9660, UDF and HFS
work in the different way) at the BEGINNING of the disc get updated (32KB
block is read into memory, get patched with new
values and written back to the media). That’s for DVDs.

So not only different file systems, but also different media types (even
different DVD media types - DVD-R Vs. DVD+RW
for example) should be handled in TOTALLY different way if you’re looking
for current valid primary volume descriptor for ISO9660
and it’s extensions.

  1. …and after that you’d find yourself working only occasionally. Just
    because what you’ve told would work only for
    CDs recorded in Track-At-Once mode. And most of the true professional CD/DVD
    burning software prefer to work
    in Disc-At-Once or Session-At-Once as they allow more control over recorded
    content. For Disc-At-Once mode you
    need to analyze whole lead-in recorded, extract track information layout
    from it (to get what’s really recorded b/s in write
    parameters mode page it would be “audio” always for this particular mode),
    descramble raw sectors and extract 2048
    byte data part from them. And only then you’ll have access to file system
    structures. For Session-At-Once you’ll have
    to parse CUE SHEET data sent to device with special command. And also find
    out what’s really recorded (also “audio”
    set in write parameters mode page). If there’s data track you’ll also need
    to descramble it (if it’s raw) and extract user data.
    Sector formats could be VERY different so extra care should be taken.

So it’s AT LEAST THREE totally different code pathes instead of one you’ve
kindly listed.

  1. See above. Current active PVD location depends upon number of sessions
    recorded and CD/DVD media type.

Regards,
Anton Kolomyeytsev

CEO, Rocket Division Software

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Sunday, January 01, 2006 11:47 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] CD Writer filtering

  1. In most cases I saw, the writes to the CD are consecutive (besides
    Alcohol, which is writing to the end of the CD first and then pass to
    the beginning). Is it possible to write to the CD in non-consecutive order?

With packet writing only. If Alcohol uses packet writing for stupid ISO
image burning - then this is a good idea to never ever use such a “smart”
app.

  1. The buffer size in the scsi command depends on the burning application.
    How can I know the write mode (write logical sector size)?

You must monitor MODE SELECT commands to WRITE PARAMETERS mode page to get
the knowledge about the sector size for this session, be it 2352 bytes or
2048 bytes.

  1. ISO primary volume descriptor is located on the logical sector #16.
    I suppose the logical sector size is written on the CD. Where can I find
    it?

ISO filesystem always uses 2048 bytes per sector. The sector size depends
not upon the disc structure, but upon the way of interpreting the disc
sectors
.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@voliacable.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

> for example. Then LBA goes to zero and

only then start to have 16 or say 30 blocks per write increments. So it may
look like the writing goes to the end of the
disc and then turns back to the beginning of it. But it’s only a “minus”
sign bit :slight_smile:

Just use the signed datatype, correct? :slight_smile:

It may also be a surprise for you but some of the multisession DVD-RWs
(restricted overwrite), all of the DVD+RWs and
DVD-RAMs could be recorded at random LBA.

I knew about +RWs. They are not much different from RAM anyway.

content. For Disc-At-Once mode you
need to analyze whole lead-in recorded, extract track information layout

I remember my code (of summer 2004) handled DAO fine. But yes, my requirement
was to only filter Nero and OS-embedded IMAPI, so, maybe I’m wrong in some gory
details.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

Thanks, Anton.

I checked the option when the LBA size is different from 2048 by using Nero
burning UDF/ISO, TAO write mode. I got sector size 2332. The first write I
received was 28 sectors starting from sector 0. When I looked at the data
buffer I found the PVD at the offset (16*2332) + 8(?), SVD was located on
(17*2332) + 8 etc. Does it mean that ISO should be interpreted in meaning of
LBA size 2332, but not 2048? Why is it 8 bytes shifted?
I calculate the sector size by dividing the buffer size in the SRB by the
number of sectors in the CDB. Is it ok?

Best regards,
Dany

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Anton A.
Kolomyeytsev (RDS)
Sent: ? 03 ??? 2006 20:00
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] CD Writer filtering

  1. Well… This is simply not true :slight_smile: What you think is the end of the disc
    is actually a negative LBA. It could be a surprise
    for you but CDs recorded in SAO or DAO mode could start from -35634 or -150
    for example. Then LBA goes to zero and
    only then start to have 16 or say 30 blocks per write increments. So it may
    look like the writing goes to the end of the
    disc and then turns back to the beginning of it. But it’s only a “minus”
    sign bit :slight_smile: It’s PERFECTLY OK for any app to burn
    ISO image in DAO or SAO mode. That’s for CDs.

It may also be a surprise for you but some of the multisession DVD-RWs
(restricted overwrite), all of the DVD+RWs and
DVD-RAMs could be recorded at random LBA. Just like hard disks. So when
multisession disc is recorded it always happens
new session is recored starting from say 10,000 LBA, user data goes there
and only then original PVD (for ISO9660, UDF and HFS
work in the different way) at the BEGINNING of the disc get updated (32KB
block is read into memory, get patched with new
values and written back to the media). That’s for DVDs.

So not only different file systems, but also different media types (even
different DVD media types - DVD-R Vs. DVD+RW
for example) should be handled in TOTALLY different way if you’re looking
for current valid primary volume descriptor for ISO9660
and it’s extensions.

  1. …and after that you’d find yourself working only occasionally. Just
    because what you’ve told would work only for
    CDs recorded in Track-At-Once mode. And most of the true professional CD/DVD
    burning software prefer to work
    in Disc-At-Once or Session-At-Once as they allow more control over recorded
    content. For Disc-At-Once mode you
    need to analyze whole lead-in recorded, extract track information layout
    from it (to get what’s really recorded b/s in write
    parameters mode page it would be “audio” always for this particular mode),
    descramble raw sectors and extract 2048
    byte data part from them. And only then you’ll have access to file system
    structures. For Session-At-Once you’ll have
    to parse CUE SHEET data sent to device with special command. And also find
    out what’s really recorded (also “audio”
    set in write parameters mode page). If there’s data track you’ll also need
    to descramble it (if it’s raw) and extract user data.
    Sector formats could be VERY different so extra care should be taken.

So it’s AT LEAST THREE totally different code pathes instead of one you’ve
kindly listed.

  1. See above. Current active PVD location depends upon number of sessions
    recorded and CD/DVD media type.

Regards,
Anton Kolomyeytsev

CEO, Rocket Division Software

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Sunday, January 01, 2006 11:47 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] CD Writer filtering

  1. In most cases I saw, the writes to the CD are consecutive (besides
    Alcohol, which is writing to the end of the CD first and then pass to
    the beginning). Is it possible to write to the CD in non-consecutive order?

With packet writing only. If Alcohol uses packet writing for stupid ISO
image burning - then this is a good idea to never ever use such a “smart”
app.

  1. The buffer size in the scsi command depends on the burning application.
    How can I know the write mode (write logical sector size)?

You must monitor MODE SELECT commands to WRITE PARAMETERS mode page to get
the knowledge about the sector size for this session, be it 2352 bytes or
2048 bytes.

  1. ISO primary volume descriptor is located on the logical sector #16.
    I suppose the logical sector size is written on the CD. Where can I find
    it?

ISO filesystem always uses 2048 bytes per sector. The sector size depends
not upon the disc structure, but upon the way of interpreting the disc
sectors
.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@voliacable.com To
unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@safend.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

>(17*2332) + 8 etc. Does it mean that ISO should be interpreted in meaning of

LBA size 2332, but not 2048? Why is it 8 bytes shifted?

CD filesystems always use 2048 bytes per sector.

2332 bytes per sector is just a pecularity of some write mode, not the real
data.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

  1. Yes, exactly! Leads to a lot of confusion.

  2. Yup. -RAM has defect management, +RW does not. Rest of the things seems
    to be pretty much the same.

  3. Well… The only way I see why it could happen - Nero really uses SAO and
    calls it for some reason DAO (true DAO is
    called Disc-At-Once/96 or so). In submode they use data is not scrambled
    (with RAW SAO or RAW SAO SUB it does). In
    the other way I just don’t understand how you’ve managed to find a CD001
    signature among trash. You can blindly try to
    descramble LBA 16 and look for PVD but it would work for single session
    media only as you don’t trace true track disc
    layout. IMAPI seems to deal with TAO only.

Regards,
Anton Kolomyeytsev

CEO, Rocket Division Software

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Wednesday, January 04, 2006 6:30 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] CD Writer filtering

for example. Then LBA goes to zero and only then start to have 16 or
say 30 blocks per write increments. So it may look like the writing
goes to the end of the disc and then turns back to the beginning of
it. But it’s only a “minus”
sign bit :slight_smile:

Just use the signed datatype, correct? :slight_smile:

It may also be a surprise for you but some of the multisession DVD-RWs
(restricted overwrite), all of the DVD+RWs and DVD-RAMs could be
recorded at random LBA.

I knew about +RWs. They are not much different from RAM anyway.

content. For Disc-At-Once mode you
need to analyze whole lead-in recorded, extract track information
layout

I remember my code (of summer 2004) handled DAO fine. But yes, my
requirement was to only filter Nero and OS-embedded IMAPI, so, maybe I’m
wrong in some gory details.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@voliacable.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

Dany,

“You’re not supposed to be here!” (c) Duke Nukem 3D

What you’ve got is truncated MODE2/Form1(2) sector. 8 bytes are for MODE2
subheader and rest is for user data (2048 bytes
of true data and rest for EDC/ECC etc). Actually I’ve never seen Nero or
anybody else burning in this quite rare mode… You may
drop me an private e-mail - I’ll send you 2 weeks unlock key for BusHound
(software SCSI bus analyzer) and could help a bit with
initial headers tracing. Also I’d recommend you to grab a copy of MMC
specification and take a look at. At least for sector formats
section. For CDs there are quite a lot of sector formats you’ll have to
support.

Yes, your assumtion is correct. For properly written software above you :slight_smile:

Well, I’d recommend you to do everything in this way:

  1. Keep track of disc recording start (you cannot just trace LBA 16 as Max
    did as you really need to support appendable
    multisession recording and not only fresh clean discs). Say at this pont
    you’ve got LBA XX. So your PVD would start at
    XX + 16 LBA offset.

  2. Check for data size in the way you’ve told (buffer size / number of
    blocks taken from WRITE10/12 CDB). If it’s 2048 - it’s
    perfectly OK to search for CD001 and rest of the signatures inside it. If
    it’s not - you need to start looking at at signature at
    the loop or so. There could be 12 bytes of synchronization at the very
    beginning, there could be 8 bytes of MODE2 subheader
    etc. Go to step 5 if you’ve located signture. Just remember internal sector
    offset for signature as you’ll need to copy 2048
    bytes of cooked data from it from every single logical blok you’ll process.

  3. If nothing was found at the step 2 you may also try to descrable the
    sector and try again step 2).

  4. Nothing was found. So it’s audio CD recorded.

  5. Parse file system copying 2048 byte sectors from known internal sector
    offset.

That’s for CDs. For some DVDs you’ll have also track sync cache and do
everything only after PVD would be updated at the
header of the disc.

That’s all… Hope it helped :slight_smile:

Regards,
Anton Kolomyeytsev

CEO, Rocket Division Software

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dani Polovets
Sent: Wednesday, January 04, 2006 6:38 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] CD Writer filtering

Thanks, Anton.

I checked the option when the LBA size is different from 2048 by using Nero
burning UDF/ISO, TAO write mode. I got sector size 2332. The first write I
received was 28 sectors starting from sector 0. When I looked at the data
buffer I found the PVD at the offset (16*2332) + 8(?), SVD was located on
(17*2332) + 8 etc. Does it mean that ISO should be interpreted in meaning of
LBA size 2332, but not 2048? Why is it 8 bytes shifted?
I calculate the sector size by dividing the buffer size in the SRB by the
number of sectors in the CDB. Is it ok?

Best regards,
Dany

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Anton A.
Kolomyeytsev (RDS)
Sent: ? 03 ??? 2006 20:00
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] CD Writer filtering

  1. Well… This is simply not true :slight_smile: What you think is the end of the disc
    is actually a negative LBA. It could be a surprise for you but CDs recorded
    in SAO or DAO mode could start from -35634 or -150 for example. Then LBA
    goes to zero and only then start to have 16 or say 30 blocks per write
    increments. So it may look like the writing goes to the end of the disc and
    then turns back to the beginning of it. But it’s only a “minus”
    sign bit :slight_smile: It’s PERFECTLY OK for any app to burn ISO image in DAO or SAO
    mode. That’s for CDs.

It may also be a surprise for you but some of the multisession DVD-RWs
(restricted overwrite), all of the DVD+RWs and DVD-RAMs could be recorded at
random LBA. Just like hard disks. So when multisession disc is recorded it
always happens new session is recored starting from say 10,000 LBA, user
data goes there and only then original PVD (for ISO9660, UDF and HFS work in
the different way) at the BEGINNING of the disc get updated (32KB block is
read into memory, get patched with new values and written back to the
media). That’s for DVDs.

So not only different file systems, but also different media types (even
different DVD media types - DVD-R Vs. DVD+RW for example) should be handled
in TOTALLY different way if you’re looking for current valid primary volume
descriptor for ISO9660 and it’s extensions.

  1. …and after that you’d find yourself working only occasionally. Just
    because what you’ve told would work only for CDs recorded in Track-At-Once
    mode. And most of the true professional CD/DVD burning software prefer to
    work in Disc-At-Once or Session-At-Once as they allow more control over
    recorded content. For Disc-At-Once mode you need to analyze whole lead-in
    recorded, extract track information layout from it (to get what’s really
    recorded b/s in write parameters mode page it would be “audio” always for
    this particular mode), descramble raw sectors and extract 2048 byte data
    part from them. And only then you’ll have access to file system structures.
    For Session-At-Once you’ll have to parse CUE SHEET data sent to device with
    special command. And also find out what’s really recorded (also “audio”
    set in write parameters mode page). If there’s data track you’ll also need
    to descramble it (if it’s raw) and extract user data.
    Sector formats could be VERY different so extra care should be taken.

So it’s AT LEAST THREE totally different code pathes instead of one you’ve
kindly listed.

  1. See above. Current active PVD location depends upon number of sessions
    recorded and CD/DVD media type.

Regards,
Anton Kolomyeytsev

CEO, Rocket Division Software

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Sunday, January 01, 2006 11:47 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] CD Writer filtering

  1. In most cases I saw, the writes to the CD are consecutive (besides
    Alcohol, which is writing to the end of the CD first and then pass to
    the beginning). Is it possible to write to the CD in non-consecutive order?

With packet writing only. If Alcohol uses packet writing for stupid ISO
image burning - then this is a good idea to never ever use such a “smart”
app.

  1. The buffer size in the scsi command depends on the burning application.
    How can I know the write mode (write logical sector size)?

You must monitor MODE SELECT commands to WRITE PARAMETERS mode page to get
the knowledge about the sector size for this session, be it 2352 bytes or
2048 bytes.

  1. ISO primary volume descriptor is located on the logical sector #16.
    I suppose the logical sector size is written on the CD. Where can I
    find
    it?

ISO filesystem always uses 2048 bytes per sector. The sector size depends
not upon the disc structure, but upon the way of interpreting the disc
sectors
.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@voliacable.com To
unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@safend.com To
unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Maxim S. Shatskih wrote:

>(17*2332) + 8 etc. Does it mean that ISO should be interpreted in meaning of
>LBA size 2332, but not 2048? Why is it 8 bytes shifted?

CD filesystems always use 2048 bytes per sector.

2332 bytes per sector is just a pecularity of some write mode, not the real
data.

2332 includes some of the headers. Including all the sync data and
headers there are exactly 2352 bytes per sector.

Also you may be sent scrambled sectors… this isn’t common these days
(the writers are smart enough to scramble in realtime durung the write…
back in the old days you had to do this manually!) but I suspect it’s
still possible… you’ll need to descramble these if they happen.

If you’re modifying sectors you may have to recalculate the ECC if
that’s being written (again I don’t know how common this is these days
or whether the software normally lets the drive do it).

The ones that I know of are:

Mode 1 - CD Audio (2048+SYNC+ECC)
Mode 2 - 2336 bytes raw data (Rare… never seen it used)
Mode 2 Form 1 - CD Data (2048+SYNC+ECC)
Mode 2 Form 2 - CD-i/XA Data (2324+SYNC) also used for VCD/SVCD.

I can’t find any reference to them any more but there used to be 3
reference guides that contained the gory details (mind you this was
something like 15 years ago when I worked on this stuff):

Red book - CD-Audio
Yellow book - CD-ROM
Green book - CD-I

Tony

> 3) Well… The only way I see why it could happen - Nero really uses SAO and

calls it for some reason DAO (true DAO is
called Disc-At-Once/96 or so).

This is according to MMC-4 spec - DAO is a subkind of SAO, if you have only 1
session.

At least one of them - IMAPI and Nero - sometimes use scrambled, non-2048 byte
sectors.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

Can you point to EXACT page in MMC spec made you think so?

Regards,
Anton Kolomyeytsev

CEO, Rocket Division Software

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Friday, January 06, 2006 3:50 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] CD Writer filtering

  1. Well… The only way I see why it could happen - Nero really uses
    SAO and calls it for some reason DAO (true DAO is called
    Disc-At-Once/96 or so).

This is according to MMC-4 spec - DAO is a subkind of SAO, if you have only
1 session.

At least one of them - IMAPI and Nero - sometimes use scrambled, non-2048
byte sectors.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@voliacable.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

MMC-4 Revision 3, dated 16-Mar-04, section 4.2.3.10 “Recording”, page 51:


There are 2 types of recording on CD-R: Uninterrupted and Incremental.
Incremental recording

requires linking, whereas uninterrupted does not.

Disc At Once is the only type of uninterrupted recording and is a special case
of Session At Once.”

Looks like MMC-4 only uses the terms “DAO” and “disc-at-once” for DVDs. So
is MMC-2 spec.

For CDs, it uses the “SAO/Raw” term sometimes, and I expect “raw” to be
what is called Disc-At-Once in Nero (SAO with 1 session for the whole disc).

Also look at Write Type field in Write Parameters mode page. It is a enum
of:

0 - packet/incremental
1 - TAO
2 - SAO
3 - raw

Note - there is no “DAO” at all.

I can only guess what is “Disc-At-Once 96”. Is it “raw”?

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Anton A. Kolomyeytsev (RDS)”
To: “Windows File Systems Devs Interest List”
Sent: Friday, January 06, 2006 7:52 PM
Subject: RE: [ntfsd] CD Writer filtering

> Can you point to EXACT page in MMC spec made you think so?
>
> Regards,
> Anton Kolomyeytsev
>
> CEO, Rocket Division Software
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
> Sent: Friday, January 06, 2006 3:50 PM
> To: Windows File Systems Devs Interest List
> Subject: Re: [ntfsd] CD Writer filtering
>
> > 3) Well… The only way I see why it could happen - Nero really uses
> > SAO and calls it for some reason DAO (true DAO is called
> > Disc-At-Once/96 or so).
>
> This is according to MMC-4 spec - DAO is a subkind of SAO, if you have only
> 1 session.
>
> At least one of them - IMAPI and Nero - sometimes use scrambled, non-2048
> byte sectors.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@voliacable.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

  1. Hmm… My one (spec I mean) lists some of the command CDB description at
    4.2.3.10. Do you have official printed copy
    or home-made draft PDF?

Whatever! Grab either CloneCD or Alcohol (I know you love it) and try to
copy freshly created multisession CD in Session-At-Once
and Disc-At-Once mode. To find out everything is just the opposite to what
you just said :slight_smile:

  1. Yup. RAW == DAO. “Disc-At-Once 96” is raw 2352 data with 96 bytes of
    subchannel. I have no clue why Ahead guys keep calling SAO
    “Disc-At-Once” in Nero. They do hang around here so maybe they would tell
    what was the reason of inventing own terminology.

Regards,
Anton Kolomyeytsev

CEO, Rocket Division Software

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Friday, January 06, 2006 7:44 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] CD Writer filtering

MMC-4 Revision 3, dated 16-Mar-04, section 4.2.3.10 “Recording”, page
51:


There are 2 types of recording on CD-R: Uninterrupted and Incremental.
Incremental recording

requires linking, whereas uninterrupted does not.

Disc At Once is the only type of uninterrupted recording and is a special
case of Session At Once.”

Looks like MMC-4 only uses the terms “DAO” and “disc-at-once” for DVDs.
So is MMC-2 spec.

For CDs, it uses the “SAO/Raw” term sometimes, and I expect “raw” to be
what is called Disc-At-Once in Nero (SAO with 1 session for the whole disc).

Also look at Write Type field in Write Parameters mode page. It is a
enum
of:

0 - packet/incremental
1 - TAO
2 - SAO
3 - raw

Note - there is no “DAO” at all.

I can only guess what is “Disc-At-Once 96”. Is it “raw”?

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Anton A. Kolomyeytsev (RDS)”
To: “Windows File Systems Devs Interest List”
Sent: Friday, January 06, 2006 7:52 PM
Subject: RE: [ntfsd] CD Writer filtering

> Can you point to EXACT page in MMC spec made you think so?
>
> Regards,
> Anton Kolomyeytsev
>
> CEO, Rocket Division Software
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
> Sent: Friday, January 06, 2006 3:50 PM
> To: Windows File Systems Devs Interest List
> Subject: Re: [ntfsd] CD Writer filtering
>
> > 3) Well… The only way I see why it could happen - Nero really uses
> > SAO and calls it for some reason DAO (true DAO is called
> > Disc-At-Once/96 or so).
>
> This is according to MMC-4 spec - DAO is a subkind of SAO, if you have
only
> 1 session.
>
> At least one of them - IMAPI and Nero - sometimes use scrambled, non-2048
> byte sectors.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@voliacable.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@voliacable.com
To unsubscribe send a blank email to xxxxx@lists.osr.com