Home

With UDF disks, files may be added, or deleted even on CD-R and DVD-R disks.  The process is achieved by a Virtual Partition, controlled by a Virtaul Allocation Table.  With a CD or DVD as sector can never be changed but new sectors can be added.  A disk contains a mixture of data area, and directory files.  The virtual partition make use of the normal directory files, but they are access through a lookup table.  This table is updated for when a new group of files is added or changed.  Logically the reading program thinks it is reading logical sector 'x' but the look up table mans that this sector can in effect be updated by pointing logical sector 'x' to a new physical location.

When reading a UDF disk, the first stage the reading program has to do is to find the current look up table, or VAT.  This is pointed to by the last sector written on the disk, and so disk searching starts from the end.  An interesting feature of this mode of operation is that by searching through the disk for these VAT pointers, the state of the disk after each session can be determined.  Forensically it is possible to see which files have been added, deleted or changed.