ISO 9660 Optical Disc Image
| Format | ISO 9660 Optical Disc Image |
|---|---|
| Short name | ISO |
| Category | disk_image |
| Platforms | Windows, macOS, Linux |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
The CD/DVD filesystem image format, also used to deliver software and malware (mounted by a double-click on Windows); on older Windows versions, files inside mounted images did not inherit the Mark-of-the-Web, which made the format popular for phishing. Volume descriptors from sector 16 on carry the volume name, creating application and separate creation, modification, expiration and effective dates including a time zone offset (in 15-minute steps); Joliet and Rock Ridge extensions add long names and Unix attributes. UDF images may coexist in the same file. Raw images with 2352-byte sectors (.bin/.cue) store the signature at a different offset.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 32769 (0x8001) | 43 44 30 30 31 | CD001 | Volume descriptor identifier 'CD001' (sector 16) |
Known extensions
.iso
References
- ECMA-119 — Volume and File Structure of CDROM (Ecma International) https://ecma-international.org/publications-and-standards/standards/ecma-119/
Cite this entry
Crush Format Reference, “ISO 9660 Optical Disc Image”. https://kalink0.github.io/crush-forensics/formats/iso/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction