Skip to content

Disc Timestamps

January 21, 2014

One of the things that confuses people a great deal is the number of different timestamps present on discs. There are many and a lot of them have never really been used for anything, much less being able to be displayed by operating systems over the years.

For example, on an ISO 9660 disc without Joliet there are five timestamps in the Primary Volume Descriptor (PVD) alone. None of these are displayable by Windows, Linux, OS X or any other operating system that I know of. Not even DOS with MSCDEX. The five are:

  • Timestamp in the root directory directory entry.
    This is not settable by any software I am familiar with and usually, but not always, comes directly from the system clock at the time the disc is being written.
  • Volume Create time
    This would be the time at which the volume was created. Unfortunately, this is often settable by the user creating the disc meaning they can put anything they want into this time.
  • Volume Modification time
    This was intended to represent the date and time the volume was republished as a CD-ROM. Today, this timestamp has little meaning although I have seen Nero doing some odd things with this with multisession discs.
  • Volume Expiration time
    This would be the time when this disc was no longer valid. Again, this dates back to CD-ROM days. As far as I know, this timestamp was never used for anything and as it isn’t displayable without special software it isn’t something the user can check. This time is often left blank or zero.
  • Volume Effective time
    This was supposed to be a time before which the disc wouldn’t be valid but again nothing I am aware of displayed or used this timestamp in any manner. This time is often left blank or zero.

Understand, that if there is a Joliet Supplementary Volume Descriptor (SVD) there is another set of these five timestamps there as well. What might it mean if they were different? I really don’t know the answer to that one.

UDF has another whole set of timestamps, the most interesting of which is called the Recording Date and Time which lives in the UDF Primary Volume Descriptor.

HFS and HFS+ also have timestamps present for: create, modify, backup and checked. Obviously everything but the create time has no meaning for a file system on write-once media, but they are all there nonetheless.

Above I mentioned some things about Nero and multisession discs – recently working with a customer I encountered something that I found pretty interesting. Normally, the root directory timestamp is set from the system clock when the disc is written. This holds true for a large number of writing applications. A few just set this to zero because it has no real use to the user or anything else – nobody is looking at it. But in general, you can take it as the true time when the file system was written.

Well, I found an exception to that. It is not clear if this is limited to a specific version of Nero or not, but a multisession disc that I was looking at recently was recorded with Nero and the 2nd and 3rd sessions had a root directory timestamp the same as the first session. Now clearly the second session was not written at the same time as the first session, so we can reject out of hand this being an accurate time when the 2nd session was written.

The Volume Create timestamp was also identical in all three sessions, lending further credence to this being a useless timestamp. However, the Volumne Modification timestamp was different and significantly later in time than the root directory timestamp and the Volume Create timestamp. Evidently what they did was to read the first session PVD (and SVD for Joliet) and only set the Volume Modification timestamp for the later sessions. Very interesting, and this will be reflected in an update to CD/DVD Inspector’s Analysis tool shortly.

CD/DVD Inspector tries to make some sense out of all of these for you without your having to resort to a hex editor and the standards document. The Analysis tool and Volume tool will both come in very handy in examining these timestamps. Also, do not forget that every file may have additional timestamp information beyond the date shown in the “details” display – right-click and select Properties to see them all.

If you have a disc that you have questions about, please let us at InfinaDyne know. If you aren’t a customer we can set you up with an evaluation version of CD/DVD Inspector right away so you can at least get a handle on what the disc has on it. If you are a customer, I personally can work with you on examining the disc to dig out all of its little secrets as I have done with a number of customers previously. Which, I might add, has led to their side winning in court. If the other side knows more about a critical disc than you do, you are going to have trouble.

No comments yet

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: