ISO File Documentation

---

Technical details

Feature	Value
Full name	ISO disc image (ISO 9660 / UDF)
File extension	.iso
MIME type	application/x-iso9660-image
Format type	Optical-disc image — sector-by-sector copy (binary)
Developer	ISO (International Organization for Standardization)
Introduced	ISO 9660 published 1988; UDF used for larger images
Standard / spec	ISO 9660:1988 (ECMA-119); UDF is ISO/IEC 13346 / ECMA-167
Open standard	Yes
Sector size	2048 bytes of user data per data sector (Mode 1)
System area	First 32 768 bytes (sectors 0–15), boot code or zeros
Byte order	Both-endian: 32-bit values stored little- and big-endian
Magic number	43 44 30 30 31 (“CD001”) at offset 0x8001
UDF identifiers	BEA01, NSR02/NSR03, TEA01 in the volume-recognition sequence
Compression	None — image is the size of the disc it represents
Boot standard	El Torito boot catalog for bootable discs
Filename limits	Level 1: 8.3 uppercase; extended by Joliet and Rock Ridge
Related extensions	.img, .bin, .cue, .nrg, .mdf, .udf, .dmg
Specification	ecma-international.org/publications-and-standards/standards/ecma-119/

What is an ISO file?

An ISO file is a complete image of an optical disc stored as one file: every file and folder from the disc, its directory structure, and the disc’s own file system, copied sector by sector. The name comes from ISO 9660, the file-system standard the International Organization for Standardization published in 1988 (also standardised as ECMA-119) to give CD-ROMs a layout that any operating system could read. An .iso holds no compression, so the file is roughly the size of the disc it represents, and burning it back to a blank disc recreates the original exactly.

Most ISO files today are never burned. Operating-system installers — Windows, Ubuntu and other Linux distributions — ship as ISO images that users either mount as a virtual drive or write to a USB stick. The extension covers two file systems in practice: classic ISO 9660 for CD-sized images, and UDF (Universal Disk Format, ISO/IEC 13346) for DVD and Blu-ray images too large or complex for ISO 9660. The sections below describe how those structures are actually laid out inside the file.

The sector layout: 2048-byte blocks and the system area

An ISO image is a flat sequence of fixed-size logical sectors. For a standard Mode 1 data disc each sector carries 2048 bytes of user data, and everything in the file is addressed by sector number rather than by raw byte offset. Sector n begins at byte offset n × 2048, which is the arithmetic every ISO parser relies on.

The first sixteen sectors (bytes 0 through 32 767) are the system area. ISO 9660 reserves this region and defines nothing in it, so on a data-only disc it is filled with zeros. On a bootable disc it instead holds boot code: for a PC BIOS this is where a master boot record or boot loader lives, which is how a burned installer disc starts a machine before any file system is read. Because this area is skipped by the file-system logic, the first meaningful structure does not appear until sector 16.

Volume descriptors and the CD001 identifier

At sector 16 (byte offset 0x8001 for the identifier field) begins the Volume Descriptor Set, a run of 2048-byte descriptors that ends with a terminator. Each descriptor starts with a one-byte type code and the five ASCII characters CD001, followed by a version byte. That CD001 string is the closest thing an ISO 9660 image has to a magic number, and it is why file-type detection for ISO looks 32 KB into the file rather than at its start.

Byte    Field                        Notes
0x8000  Volume Descriptor Type       0x01 = Primary Volume Descriptor
0x8001  Standard Identifier          "CD001" (5 bytes)
0x8006  Version                      0x01
0x8008  System Identifier            32 bytes, A-characters
0x8028  Volume Identifier            32 bytes, disc/volume name
0x8050  Volume Space Size            both-endian uint32: total sectors
0x809C  Volume Set Size / Seq.       both-endian uint16 pairs
0x80A0  Logical Block Size           both-endian uint16, normally 2048
0x80A4  Path Table Size              both-endian uint32
0x80B6  Root Directory Record        34-byte record for the root folder

The descriptor type code identifies the kind: 0x00 a Boot Record, 0x01 the Primary Volume Descriptor (PVD), 0x02 a Supplementary Volume Descriptor (used by Joliet for long, Unicode filenames), and 0xFF the Volume Descriptor Set Terminator that marks the end of the list. The PVD is the master record: it names the volume, states the total size in logical blocks, points at the path table, and embeds the directory record for the root directory, from which the whole tree is reachable.

ISO 9660 stores its multi-byte integers in an unusual both-endian form: a 32-bit value is written once little-endian and then again big-endian, back to back, eight bytes in total. This lets a reader on either processor architecture pick the ordering it prefers without byte-swapping, at the cost of doubling the space those fields occupy.

The path table and directory records

Two parallel structures describe the folder tree. The path table is a compact list of every directory on the disc, each entry giving the directory’s name, the sector where its contents start, and the index of its parent. Because it is a flat list, a reader can locate any directory with one lookup instead of walking the tree from the root, which mattered when seeking on a physical drive was slow. ISO 9660 stores two copies, an L-path-table (little-endian) and an M-path-table (big-endian).

The tree itself is built from directory records. Each record is variable length and describes one file or subdirectory: the length of the record, the starting sector (extent location) as a both-endian uint32, the data length in bytes, a seven-byte date-and-time, a flags byte (bit 1 marks a directory), and the file identifier. Plain ISO 9660 Level 1 restricts that identifier to uppercase letters, digits and the underscore in 8.3 form, and real files carry a trailing ;1 version suffix. Two extensions relax this: Joliet (via a Supplementary Volume Descriptor) stores UCS-2 Unicode names up to 64 characters for Windows discs, and Rock Ridge adds POSIX attributes, long mixed-case names and symbolic links for Unix discs. A single disc often carries all three name spaces so that any operating system sees usable filenames.

UDF: the file system behind large DVD and Blu-ray images

ISO 9660 was designed around CD capacities and 2 GB file-size limits, so DVD-Video, Blu-ray and most large images use UDF (Universal Disk Format), the ECMA-167 / ISO IEC 13346 file system, while still using the .iso extension. A UDF image opens with a Volume Recognition Sequence near sector 16 whose descriptors are tagged BEA01 (Beginning Extended Area), NSR02 or NSR03 (the NSR descriptor naming the UDF revision, 2.00 or 3.00), and TEA01 (Terminating Extended Area). Many images are written as “UDF bridge” discs that also carry an ISO 9660 structure, so an older reader still sees files even if it does not understand UDF. UDF removes the 8.3 name and small-file limits, supports files larger than 4 GB, and is what DVD players and Blu-ray drives actually parse.

El Torito: how an installer ISO boots

A plain data ISO cannot start a computer. The El Torito specification adds that ability. It places a Boot Record volume descriptor (type 0x00, identifier CD001) at sector 17 whose payload points to a boot catalog elsewhere on the disc. The catalog lists one or more boot entries, each naming the sector of a boot image and how the firmware should present it. Two boot styles exist: floppy/hard-disk emulation, where the firmware pretends the boot image is a small disk, and no-emulation, used by modern installers, where the firmware loads the boot image straight into memory and jumps to it. UEFI machines read an El Torito entry that points to an EFI system partition image instead. This is why the same ISO can be burned to a disc and booted, or written raw to a USB stick and booted, without any change to its contents.

Mounting versus extracting: reading an ISO without a disc

Because an ISO is a full file system in a file, an operating system can attach it directly as a loop or virtual device and browse it as though a disc were inserted. Windows 8 and later mount an ISO natively (right-click › Mount), macOS mounts it on double-click, and Linux uses mount -o loop file.iso /mnt. Nothing is copied; the kernel simply reads directory records and file extents out of the image on demand. Extraction with an archive tool such as 7-Zip works differently: it reads the same directory records but writes each file’s extent out to disk as an ordinary file, which is how you recover a few files without mounting or burning. Most other disc-image formats, including NRG, MDF and BIN/CUE, are proprietary or split-track containers that tools convert into the open ISO layout so they can be mounted or burned anywhere.

Why ISO files became a malware-delivery method

The ISO container itself is passive data and runs nothing on its own, but the way operating systems handle it created a security problem worth understanding. When Windows mounts a downloaded ISO, the files inside the image historically did not inherit the “Mark of the Web” (the Zone.Identifier alternate data stream) that flags content as coming from the internet. An attacker could therefore ship a small ISO containing an executable or a shortcut, and when the victim mounted it and ran the file, SmartScreen and Office’s Protected View warnings were bypassed because the loader saw a “local” file. Phishing campaigns used exactly this to smuggle payloads past mail filters. Two practical rules follow: download operating-system ISOs only from the official vendor and verify the published SHA-256 checksum before mounting, and be wary of unexpectedly small ISO attachments. Separately, avoid legacy mounting utilities with compromised installers — native mounting plus Rufus, Ventoy or 7-Zip covers the real use cases.

Frequently asked questions

Why does the ISO signature sit 32 KB into the file?

ISO 9660 defines the first sixteen 2048-byte sectors as a reserved system area for boot code, so the file system does not begin until sector 16. The Primary Volume Descriptor and its CD001 identifier live there, at byte offset 0x8001. The opening 32 768 bytes carry no signature and are usually zeros, which is why identifying an ISO requires reading past them.

Why are numbers stored twice in an ISO?

ISO 9660 uses a both-endian encoding: each 16- or 32-bit value is written once little-endian and again big-endian. A reader on any processor picks the ordering native to it without byte-swapping. The trade-off is that these fields take twice the space, a deliberate portability choice from an era of mixed big- and little-endian hardware.

What is the difference between ISO 9660 and UDF in an .iso?

ISO 9660 is the original CD file system with 8.3 names and small size limits; UDF (ECMA-167) is a newer file system that supports large files, long names and DVD/Blu-ray capacities. Large images keep the .iso extension but use UDF, often as a “bridge” disc that carries both so old and new readers each find files.

References

• ECMA-119 — Volume and File Structure of CDROM (ISO 9660)
• ECMA-167 — Volume and File Structure (UDF base standard)
• Microsoft Support — Burn or mount a disc image (ISO)

Feedback

Was this page helpful?

Yes No

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.