How to Find Out Who Made an ISO Disk?

If a file is saved using Microsoft word or some other type of program, you can right click on the file to find the properties, which will indicate the computer that created the file.

Is there anyway to find out who created an ISO disk image on a CD or DVD? I assume that there should be no meta data on the disk because an ISO disk image should be an exact duplicate of the original. Is my assumption correct?

To illustrate with an example, let's say you found a CD at a cafe or something. You decide to look at the CD with your computer. You find out that it is an "Ubuntu live CD" that was obviously created from an ISO file. Is there any way to find out who burned the CD? Or, on the flip side, let's say you were the one that burned the "Ubuntu live CD" and you lost it. Would somebody be able to know that it was you who made the CD? Can they get any info about the maker?

Qwertyfshag

Posted 2012-09-24T19:50:56.253

Reputation:

3No, there's no extra metadata on it. – slugonamission – 2012-09-24T19:52:38.330

1It was most likely burned by someone who wrote a bios trojan or virus to your eeprom shortly before you figured out it was a "ubuntu live CD" – Gung Foo – 2012-09-24T19:58:02.727

@gung foo. wtf ? – Sirex – 2012-09-24T20:58:10.240

@Sirex The picking up random stuff lying around method is a common vector for virus infection. A security company recently left infected flash drives lying around an office space to test this out, and a surprising number of people picked them up and plugged them in to their workstations. – NReilingh – 2012-09-24T21:37:57.947

Yeah, sure, but "most likely" ? I'd have thought most likely is 'someone forgot their cd', seconded by 'someone messed up burning a cd', ...distant thirded by 'vigilante linux mafia gorilla physops warfare' – Sirex – 2012-09-24T21:43:20.417

Answers

No. An ISO file contains all the information that goes on the disk. Two disks produced from identical files will read the same data back. Special procedures can enable the addition of more information to the disk, usually to artificially increase the complexity of manufacture, but that (at the very least) requires additional hardware and someone doing it on purpose.

Occasionally someone claims all/most/some disk writing devices add their serial number & c. weakly embedded in the data stream/between sectors/in subchannels, for the benefit of law (or any other) enforcement. Most people don't believe them. It has however been shown that some printers (for paper) print their numbers very faintly in yellow toner, so it might not be as far out as one would like.

Eroen

Posted 2012-09-24T19:50:56.253

Reputation: 5 615

You'd think from the fact law enforcement has never ever once used this secret hidden track data in a conviction, perhaps people would conclude that's because it's entirely fictional ? Ugh. – Sirex – 2012-09-24T21:35:38.230

@Sirex I refuse to take a side on the issue, but one might choose to believe that they are waiting for a big fish on the assumption that the trick will work better the first time. There's also the bit about illegal surveillance being less problematic early in an investigation than in a court room. – Eroen – 2012-09-24T21:44:10.467

ISO disc images can contain metadata such as Volume Label, System Identifier, Volume Set, Publisher, Data Preparer, Application and so on:

ISO Properties in MagicISO

These persist even when the image is burnt to disc. I just ran isoinfo for Windows on one of my discs, and it displayed all the info. I had set prior to burning, in the following format (actual details deleted):

CD-ROM is in ISO 9660 format
System id:
Volume id:
Volume set id:
Publisher id:
Data preparer id:
Application id:
Copyright File id:
Abstract File id:
Bibliographic File id:
Volume set size is:
Volume set sequence number is:

It's not going to happen automatically, but I suppose if someone bothers to include those details (such as their name, address etc. in the Data preparer field), anyone with the right tools can access them from the disc.

Karan

Posted 2012-09-24T19:50:56.253

Reputation: 51 857

To emphasise your point and avoid confusion; these properties are all set in the ISO image, by whoever prepares that, so they can not be used to identify who created the disk. – Eroen – 2012-09-25T08:06:20.977