Unerase CD-RW
Previous Topic  Next Topic 

Home


With CD-RW disks it is possible to erase them.  Once erased, logically they look like a new blank disk.  Physically though, one can normally see that the disk has been written to by the different colour on the data side of the disk.  This is a forensics only option.


It must be noted that when dealing with blank disks, the progfram can take a long time (maybe 30 seconds) to try and read a blank sector.  This can cause the program to appear to hang, so please do not give up immediately.


Most programs will treat an erased disk as just that, and there is no way to recover the data.  CnW software does have a way that normally works to in effect unerase the disk, and make the disk readable again.


There are two modes to disk erasing, a quick erase, and a full erase.  A quick erase just sets all pointers on the disk, in hidden areas to make it look like a new disk. This mode can be recovered. A full erase will overwrite each sector, and this means that data can never be recovered.


This routine changes elements of the disk so that it may read using CnW Recovery software.  A small side effect is that the first 16 sectors of the disk remain blank, and it cannot be read using the standard operating system.


Recovery of erased CD-RW disks


A problem with an erased CD-RW is that it looks just like a blank disk, and it is impossible to determine what has happened to it without doing the unerase process.  It must be noted that the unerase used in CnW does actually write to the disk and so potentially it could damage a disk that has failed, but not due to being erased. It should therefore be treated with caution, but at the same time it may be the only option.  This function, believed to be unique on commercial user software, can be slightly problematic, but it does normally produce the desired results, although occasionally multiple attempts may be required.


The Wizard on CnW will highlight disks that are possibly erased. In these cases, the Manual Recovery mode should be entered, and on the CD recovery options menu there is a button for Unerase disk, which is only enabled when a blank disk is detected. When the function is selected, a new screen is displayed with many options on. As mentioned above, the configuration of the disk before erasing can normally only be guessed at, and so the unerase may need to be done in different ways until the correct combination is found.




It is necessary to try and replicate how the disk was written first of all.  Some combinations will display the error message "Error setting SelectMode" when the Unerase button is pressed.


A good starting point is to use the variables shown above. The one very important parameter is the Data Block Type. If the incorrect value is chosen, then the data on the disk will be 8 bytes out of sync.  However, there is a test at the end of the unerase that will ensure the correct value has been entered.  If the value was wrong, then it will be necessary to Blank CD and select a different Data block type before doing a new Unerase function.


The result after Unerasing should be a message "Unerase complete and sector read OK". This shows that the prgram can now read a test sector after the unerase operation.  The Normal CnW CD recover functions can now be used, but the user should be aware that it is occasional very slow starting.


Sometimes, there is a 'false' error message saying that the unerase has failed.  Before doing anything, the disk should be tried, with the view function and an attempt to read sectors above 16 (0x10) should be made.  If this works, then a recover function can be tried.



The parameters that can be changed are displayed below.  As details of the original disk may be unknown, there is an element of trial and error



Fixed packet size

This mode is used on disks that have setup to be a read/write disk.  For disks that are written as a standard CD, then the fixed packet size will not be set.


Packet size


The normal value is 0x20 (32 sectors). If fixed packet size is not set, this value is not used



Multi-session

This is a flag used for data will be added to the disk - it should be set to 3



Data block type


This is the type of disk that has been written.  All three modes will be found on disks.



Write type


Session format

The most common type of disk will be a CD-DA



Error messages


Last RZone not visible.  If this is found, re-blank the disk and try again



This program is part of the Forensic Option.  If it is required to recover a CD-RW (or DVD-RW) then CnW do offer a service at a fixed fee of £30 (or £40 for DVD).  Please e-mail info@cnwrecovery.com for more details.



The same software option for DVD-RW has not been developed yet, so the only solution is the service described above.