Analysis of a formatted disk #1

So, let’s have a look at the 2GB formatted disk.

00000000-10003FFF 256MB of zeroes
10004000-1000406F block with 'CRedundantABS Copyright LSI Logic, Inc. 2004'
10004200-1000449F block with 'CLsiPMABS Copyright LSI Logic, Inc. 2004'
10004A00-10004A6F block with 'CRedundantABS Copyright LSI Logic, Inc. 2004'
10004C00-10004CAF block with 'CLsiPMABS Copyright LSI Logic, Inc. 2004'
100051E0-100052A0 block with 'TFS2'
10005400          57004300        30003000        30003000        00000000

From here we get 2048 blocks of 512 bytes each that look like directory entries.

100054f0          00000000        00000000        00000000        57004300
10005500          00000000        00000000        00000000        00002080
10005510          00000000        00000000        00000000        00000000
*
10005540          40000000        00000000        00000000        00000000
10005550          00000400        00000000        00000000        00000000
10005560          00000000        00000000        00000000        00000000
*
100055d0          00000000        00004000        00000000        00000000
100055e0          00004000        00000000        00000000        00000000
100055f0          00000000        00000000        00000000        00000004
10005600          56002f00        5f005200        41004d00        47004e00
10005610          2e005200        46004900        00004f00        00000000
10005620          00000000        00000000        00000000        00000000

The first entry differs from the following in that it contains a string. The string is

/VR_MANGR.IFO

with a 2-byte UTF-16 like encoding. This is clearly a file name, since an IFO file “contains headers that tell the DVD player what screen to
show at startup, where each chapter starts, where audio tracks are located
on the disc, etc; works in conjunction with .VOB and .VRO files, which
contain the actual audio and video data.” (http://www.fileinfo.net/extension/ifo).

The word on the top-right (57004300) looks like an address. The second directory entry has address 67002a00 and an empty string. The third until 2048th entry have address ffffffff.

The last entry starts at 101054f0 and is slightly different as its string is not all-zero:

10105600          0f0f100f        00000000        00000000        0f0f0000
10105610          00000000        00000000        00000000        0000100f

So we have 1MB of directory entries, each 512 bytes, so a total of 2048 entries. I guess this means that the number of movies on the disk is limited to 2048.

At 101056a0 starts another repeating pattern that looks like an allocation table:

101056a0          00000000        00000000        ffffffff        ffffffff
101056b0          ffffffff        ffffffff        fffeffff        ffffffff
101056c0          ffffffff        ffbffefb        ffff7fff        ffffffff
101056d0          ffffffff        ffffffff        ffffffff        ffffffff
101056e0          ffffffff        ffffffff        ffefffff        ffffffdf
101056f0          ffffffff        dfffffff        ffffffef        ffffffff
10105700          ffffffff        ffffffff        ffffffff        ffffffff
10105710          ffffffff        ffffffff        fffffbff        ffffffff
10105720          ffffffff        ffffffff        ffffffff        ffffffff
10105730          fffffffb        ffffffff        7fffffff        ffffffff
10105740          ffffffff        ffffffff        fffdffef        fffff7ff
10105750          ffffffff        ffffffff        ffffffff        ffffffff
10105760          ffffffff        ffffffff        ffffffef        ffffffff
10105770          ffffdfff        ffffffff        ffffffff        fffffffd
10105780          ffffffbf        ffffffff        f7ffffdf        ffffffff
10105790          ffffffff        fffffdff        ffffffff        7fffffff
101057a0          ffffffff        ffffffff        ffefffff        ffdfffff
101057b0          ffffffff        ffffffff        ffffffff        ffffffff
*
101057d0          ffffffff        fdfffffb        fbffffff        ffffffff
101057e0          ffffffff        ffffffff        ffffffff        ffffffff
101057f0          fffffeff        ffffffff        ffffffff        fffffbff
10105800          ef00f000        00000000        100f0000        ff0f0000
10105810          00000000        00000000        00000000        0000f000
10105820          00000000        00000000        00000000        00000000
*

Leave a Reply

You must be logged in to post a comment.