.ISO File Format – UDF

Finding UDF in an image

1. The volume recognition sequence starts in the first sector after the first 32,768 bytes: sector 16 with 2,048-byte sectors, the same place as ISO 9660’s volume descriptors. An NSR02 or NSR03 descriptor there says the volume may be recorded with ECMA-167.
2. An anchor volume descriptor pointer at sector 256 (and at the last sector, or 256 before it) gives the extent of the volume descriptor sequence.
3. The volume descriptor sequence holds the primary volume descriptor, partition descriptors and the logical volume descriptor.
4. The logical volume descriptor points to the file set descriptor, which points to the root directory’s ICB.
5. Directories are files of file identifier descriptors, each pointing to a file’s ICB, whose file entry lists where the data is.

A disc that carries both ISO 9660 and UDF is what UDF calls a UDF Bridge disc (UDF 6.11.4): ISO 9660’s primary volume descriptor stays at sector 16, and its directories may refer to the same files as the UDF structures, or to different ones.

Volume recognition sequence

Each volume structure descriptor fills one sector (ECMA-167 2/9.1). The sequence ends at the first sector that is not a valid descriptor (2/8.3.1); UDF requires that sector to be unrecorded or zero (UDF 2.1.7).

UDF 2.1.7 requires exactly one NSR descriptor, inside a single extended area that starts with one BEA01 and ends with one TEA01; any other descriptors, such as the ISO 9660 set, come before it.

00009000  00 42 45 41 30 31 01 00 00 00 00 00 00 00 00 00  .BEA01..........
00009800  00 4E 53 52 30 33 01 00 00 00 00 00 00 00 00 00  .NSR03..........
0000A000  00 54 45 41 30 31 01 00 00 00 00 00 00 00 00 00  .TEA01..........

Descriptor tag

Every descriptor from here on starts with a 16-byte tag (ECMA-167 3/7.2 and 4/7.2).

Anchor volume descriptor pointer

ECMA-167 3/8.4.2.1 allows anchors at sectors 256, n − 256 and n (the last sector), and at multiples of n ÷ 59; UDF 2.2.3 requires at least two of 256, n − 256 and n. (An unclosed sequential write-once disc may have a single anchor at 256 or 512.) At 2,048 bytes per sector, sector 256 is offset 0x80000.

Volume descriptor sequence

One descriptor per sector, ending with a terminating descriptor (tag 8), a volume descriptor pointer (tag 3) to a further extent, or an unrecorded sector (ECMA-167 3/8.4.2). Each descriptor below begins with its tag and a 4-byte volume descriptor sequence number at 16.

Primary volume descriptor (tag 1)

Partition descriptor (tag 5)

Logical volume descriptor (tag 6)

A partition map starts with its type and its length. Partition reference numbers in Part 4 addresses are indexes into this list, starting at 0.

File set descriptor (tag 256)

In Part 4, addresses are logical block numbers within a partition: an lb_addr is a 4-byte block number and a 2-byte partition reference number; a long_ad is a 4-byte length, an lb_addr and 6 bytes of implementation use (ECMA-167 4/7.1, 4/14.14.2).

ICB tag

An information control block (ICB) holds a file’s entries. Each entry is a descriptor tag, then this 20-byte ICB tag at offset 16 (ECMA-167 4/14.6).

File entry (tag 261) and extended file entry (tag 266)

A file entry describes one file or directory and fits in one logical block (UDF 2.3.6). The extended file entry adds an object size, a creation time and a stream directory, which moves the later fields.

A short_ad is 8 bytes: a length whose low 30 bits are the bytes and top 2 bits the extent type (0 recorded and allocated, 1 allocated but not recorded, 2 neither, 3 the next extent of allocation descriptors), then a 4-byte logical block number in the same partition (ECMA-167 4/14.14.1). A long_ad has the same length field and a full lb_addr.

File identifier descriptor (tag 257)

A directory’s data is a run of these, each padded to a multiple of 4 bytes (ECMA-167 4/14.4).

Strings, times and identifiers

• OSTA CS0 (UDF 2.1.1): a compression ID byte, then the characters: 8 for one byte per character, 16 for two bytes per character, most significant byte first; 254 and 255 mark an empty, unique name in deleted file identifiers. The charspec naming it is type 0 followed by OSTA Compressed Unicode.
• dstring (UDF 2.1.3): a fixed-size field whose last byte holds the number of bytes used, including the compression ID; an empty string is all zeros.
• timestamp (ECMA-167 1/7.3, UDF 2.1.4): 12 bytes: type and time zone (2; top 4 bits type, 1 for local time; low 12 bits a signed offset from UTC in minutes, −2047 for none), year (2, signed), month, day, hour, minute, second, centiseconds, hundreds of microseconds, microseconds (1 each).
• regid, UDF’s EntityID (ECMA-167 1/7.4, UDF 2.1.5): flags (1, zero in UDF), identifier (23) and identifier suffix (8). For *OSTA UDF Compliant the suffix starts with the UDF revision as a 16-bit number, 0x0260 for 2.60, then domain flags (bit 0 hard write-protect, bit 1 soft write-protect).