I have had loads of success in "dating" cd images, linux's mkisofs and at least a handful of windows iso image creation tools embed the iso image creation date time into the image. mkisofs is nice enough to even provide the exact command line used to create the image which can pinpoint "hidden" data within the image via the '-hide' and '-hide-joliet' mkisofs options. Sorry I'm unable to provide exact offsets at the moment, I had never thought of documenting all of these findings but now think it might be worthwhile to have a matrix available. Just crank up hexedit on the raw cd and scroll for a second or so... it's very easy to find. Even easier 'strings' output analysis would accomplish the same. -- William Salusky changeat_private ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Tue Oct 08 2002 - 07:16:25 PDT