CD disc not readable in Windows, only DOS !!??

Hello all. I have an odd problem I'm trying to solve. I have a cd that shows up as blank in Windows based systems. However it's not blank. I've tried all kinds of utilities like IsoBuster, MagicISO, PowerISO etc. and other CD/DVD diagnostic tools to try and see the data. Under Windows it's convinced the data is not there.

Now... when I boot off the cd, it boots into DOS. The data is now visible. There's some text saying Nero Express, so I imagine the disc was created/burnt using Nero. From what I can gather this disc is a floppy or hard drive emulation one. But why can't I see it in Windows and be able to copy the files with LFN preservation?

I am able to duplicate this disc, and the burnt copy will boot up as well, but the same problem exists in that you cannot see the discs contents in Windows. Making an .ISO of this disc, it tells me 250mb. But when in DOS, the total amount of data is only 90mb. So wondering where the other 140mb is, or is it just phantom space and not data at all.

I tried a tool called InfinaDyne called CD/DVD Inspector and this was the report it gave me:

Quote

I've spent several hours on this trying to get somewhere. I think the disc is in El Torito format judging from what my Gooogling turned up. That's how I ended up here . Hoping someone can help.

If you can make an ISO image of your CD, you can extract the hard disk (or floppy image) from this ISO image with 7-zip.

It is possible to hide files on a CD (when the ISO image is created), so that it looks that the files aren't there.

For example mkisofs supports this options:

  -hide GLOBFILE			  Hide ISO9660/RR file
  -hide-list FILE			 File with list of ISO9660/RR files to hide
  -hidden GLOBFILE			Set hidden attribute on ISO9660 file
  -hidden-list FILE		   File with list of ISO9660 files with hidden attribute
  -hide-joliet GLOBFILE	   Hide Joliet file
  -hide-joliet-list FILE	  File with list of Joliet files to hide
  -hide-joliet-trans-tbl	  Hide TRANS.TBL from Joliet tree
  -hide-rr-moved			  Rename RR_MOVED to .rr_moved in Rock Ridge tree

All options that start with "-hide" will hide the files so you can't see them as available.
All options that start with "-hidden" will set the hidden attribute to the file (you can still see them when you allow explorer to show hidden files).

Hey Icecube. I installed 7-Zip and opened the .iso file I made from the disc. All I see is a one directory called [BOOT]. And inside of that there is one file only called "Bootable_HardDisk.img". Is there another step to see the rest?

KoolMonkey, on Mar 30 2010, 10:29 AM, said:

Try "opening inside" with 7-zip.

It is likely that 7-zip can open it, otherwise extract the bootable_Hardisk.img, it should be a largish file, up to roughly 650 Mb, and then try mounting it with IMDISK, or Winimage or VDK, or any similar tool capable of accessing or mounting a hard disk image.

To hopefully clear the matter what you have in your hands is a Hard disk emulation CD-rom.

Read here:
http://www.winimage....opic.php?t=2454
And here:
http://www.boot-land...?...c=3890&st=6


Wonko

Wonko the Sane, on Mar 30 2010, 11:34 AM, said:

An update on this. Wonko I think you're right. After looking at this on and off for the past few weeks, and studying the .iso more, I think I've discovered a thing or two.

One, this .iso was indeed made using the "Hard Drive Emulation" mode. Even though the data comes to about 80mb, the image itself is 250mb. So it's possible a image was made from a 250mb hard drive partition that contained only 80mb of data.

The disk was burnt using Nero. The reason I cannot see any of the data inside Windows is because it's all contained within the boot loader itself. Normally you would use Floppy Emulation that can use 1.44MB or 2.88MB image sizes, but since the burn method is Hard Drive Emulation, there is no size restriction.

Thus the data is only visible once the disk boots and loads the hidden image.

Using IsoBuster, I was able to see the boot disc details. It shows the .img size is 2mb, but actually it's 250mb. IsoBuster simply cannot deal with the image size being bigger and thus takes a guess it's a 2mb size. I'd love to be able to open this .iso with a program that can extract the .img file in it's entirety. So far only Isobuster can extract it. I've tried WinImage, UltraISO and quite a few others, but this is as far as I've been able to get.




As you can see in the pictures, there's the boot loader info, and in the second what appears to be a "blank" cd.

The mkisofs info about hiding the file system when creating an .iso was interesting. I thought maybe my image had this done to it, but after looking at it more, it doesn't look like it has. My disc is simply one giant hard drive image, where the data is only visible if the disc itself has been booted of it.

Now that I think I've worked it out, the fun is then in how to recreate this effect I've been playing around with Nero for hours but can't seem to get a disc that is bootable in this method. The load segment is set to 0x7c0 and the loaded sectors to 04 which is the setting for a hard drive image. Don't know what I'm doing wrong, but it's something obviously lol

What do you guys think?

KoolMonkey, on Apr 15 2010, 11:02 AM, said:

Did you try 7-zip?

KoolMonkey, on Apr 15 2010, 11:02 AM, said:

You can try the following mkisofs command:

mkisofs -o ../mynewiso.iso -b /yourharddiskimage.img -hard-disk-boot .

Can you give a link to the iso that you are using?

Icecube, on Apr 15 2010, 01:26 PM, said:

Yes I've tried 7-zip before and it doesn't work as good as Isobuster. Though 7-zip "sees" things a little different. Instead of the file being called "Arnes Boot Record.img" 7-zip reports it as "Bootable_HardDisk.img". And the size is only 512 bytes vs the 2mb file being reported in Isobuster. So this only adds to the hmm factor that different programs are reading different things with my .iso.

I'll give the mkisofs command a try. Thanks for the tip.

I don't have a link for the .iso I'm referring to as it wasn't a download.

If 7-zip only shows "Bootable_HardDisk.img" (512bytes) and not the full hard disk images then this means that the actual hard disk image is made invisible. The "Bootable_HardDisk.img" is the MBR of the hard disk image.

You can manually extract the hard disk image.
For some background about the El Torito specification (bootable CDs), read (page 9 and 10):
http://www.phoenix.c.../specscdrom.pdf

You can also look at this example. The ISO used there uses no-emulation instead of a hard disk emulation, but it explains the El Torito Structure of bootable iso's well:
http://odin.himinbi....extraction.html

So basically you need to extract the boot catalog of your ISO (BootCatalog.cat in your case).
Open it with a hexeditor. It should look similar to this:

Quote

Boot Indicator: 88 means that you have a bootable ISO
Boot Media Type: 04 means that the ISO uses hard disk emulation
Load RBA (start address of the virtual disk): 1a 00 00 00 ==> you need to reverse this value: 0x0000001a=26

A sector on a CD is 0x800=2048 bytes. So your hard disk images starts at RBA * CD sector size.
So for my ISO, the hard disk image starts at byte:
26*2048=53248

For example, you can now extract the image with dd:

dd if=myiso.iso of=extracted-hdd.img bs=2048 skip=26

Where:

• myiso.iso = the iso from which you want to extract the hard disk image
  
• extracted-hdd.img = filename that you want to give to the extracted hard disk image
  
• bs=2048 ==> block size is 2048 bytes (= CD sector size)
  
• skip=26 ==> use the RBA value here (will skip the first 26 sectors (26*2048 bytes) of the ISO)

Now you have your hard disk image. It will probably be a little bit bigger than the one that was used to create the ISO (some extra zeros at the end of the image). If you want to fix that, you probably need to post the MBR of the extracted hard disk image, so the minimum size of the image can be calculated based on the partition table info. I don't want to spend time on this. Maybe Wonko wants to help with it.

You can recreate the iso now, if you want.
Create an empty directory (called hdd-iso) an copy extracted-hdd.img to it.
Get mkisofs and put it one directory up of the empty directory that you created.
Cd to this directory with the Command Prompt program and run:

mkisofs -o yournew.iso -b extracted-hdd.img -c boot.cat -hard-disk-boot hdd-iso

You can hide the hard disk image and the boot catalog file too (like in the original iso):

mkisofs -o yournewhidden.iso -b extracted-hdd.img -c boot.cat -hard-disk-boot -hide extracted-hdd.img -hide boot.cat hdd-iso

Look at the difference between the 2 iso's with 7-zip.

IsoBuster gives the LBA addresses already for you:

Probably you need to subtract 1 from the value that you see, because it is possible that it starts counting from 1 instead of from 0. So RBA will probably be 26 for you too. You can extract the "Bootable_HardDisk.img" from the ISO and compare the bytes with the first 512 bytes of the extracted image. If they match when you use:

dd if=myiso.iso of=extracted-hdd.img bs=2048 skip=26

IsoBuster starts counting LBA offsets from 1 instead of 0.

If the first 512 bytes of the extracted hard disk image match when you use:

dd if=myiso.iso of=extracted-hdd.img bs=2048 skip=27

IsoBuster starts counting LBA offsets from 0, like it should.

If you are still interested in extracting the hard disk image, you could try the bExtract batch file written by Wonko the Sane:
http://www.boot-land...?...12406&st=30