Physical Media That Requires Physical Destruction
Optical media, including CDs, DVDs, and Blu-ray discs, may seem like relics of an earlier era, but they remain in use across many organisations. Archival copies of data, software installation media, backup discs, training materials, and legacy records are commonly stored on optical media. When these discs reach end of life or are no longer needed, the data they contain must be destroyed properly.
Unlike magnetic or solid-state media, optical discs cannot be overwritten or degaussed. Their physical structure means that destruction, rather than sanitisation, is the primary disposal method.
How Optical Media Stores Data
Optical discs store data in a physical pattern of pits (indentations) and lands (flat areas) on a reflective layer within the disc. A laser reads these patterns to retrieve the data. On recordable (CD-R, DVD-R) and rewritable (CD-RW, DVD-RW) media, the data is stored by altering the properties of a dye layer or phase-change material using a laser.
Because the data is encoded in the physical structure of the disc, it cannot be erased by electromagnetic means (degaussing has no effect) or by standard software overwriting tools. Even on rewritable discs, simply formatting or erasing the disc through the operating system does not reliably eliminate all trace of the original data, as the physical changes to the recording layer may still be detectable.
Types of Data on Optical Media
Organisations may find a surprising range of sensitive data stored on optical discs. Software installation media with licence keys and serial numbers embedded in the disc contents. Backup copies of databases, email archives, or file servers. Financial records burned to disc for archival purposes. Medical records and diagnostic images (particularly in healthcare, where DICOM images were historically distributed on CD). Legal documents and case files. Training and presentation materials that may contain confidential information. Music, video, or other media that may be subject to intellectual property protection.
The sensitivity of data on optical media is often underestimated because the media itself seems outdated. But the data burned onto a DVD ten years ago may include information that is still confidential or subject to privacy obligations.
Destruction Methods
Industrial shredding: The most effective method for optical media destruction is industrial shredding using a cross-cut shredder rated for optical media. Office paper shredders are not suitable, as they may not cut the disc into pieces small enough to prevent data recovery and may be damaged by the hard polycarbonate material.
Purpose-built optical media shredders reduce discs to small fragments, typically 4mm or smaller. At this particle size, the data tracks on each fragment are too short and too damaged to be read, even with specialised equipment.
Dedicated disc destroyers: Desktop disc destruction devices are available that are specifically designed for CDs, DVDs, and Blu-ray discs. These devices typically use a grinding or scoring mechanism that destroys the data surface of the disc without shredding it into fragments. While less thorough than full shredding, these devices are convenient for small-volume destruction in office environments.
Abrasion and scratching: Severely scratching or abrading the data surface of a disc can make it unreadable by standard optical drives. However, this method is not considered reliable for sensitive data, as professional data recovery services may still be able to read some data from damaged discs using error correction and specialised readers. Abrasion is suitable only for low-sensitivity data.
Incineration: Burning optical discs at high temperature destroys them completely. However, this must be done at a licensed facility because burning polycarbonate releases toxic fumes (including bisphenol A). Backyard burning is not appropriate and may violate environmental regulations, including Victoria’s e-waste disposal requirements.
Chemical destruction: Some industrial processes use chemical solvents to dissolve the polycarbonate substrate and data layer of optical discs. This is not practical for most organisations but may be used by specialist destruction providers for large volumes.
Handling and Collection
Optical media is often scattered across an organisation rather than centralised. Discs may be stored in desk drawers, filing cabinets, storage rooms, and even personal bags. Implementing a collection programme for optical media requires communicating to staff that discs should be returned for secure disposal rather than thrown in general waste.
Provide clearly labelled collection bins in common areas for staff to deposit discs awaiting destruction. These bins should be secure (lidded and lockable) to prevent unauthorised access to the discs before they are destroyed. Periodically collect the accumulated discs and process them through your chosen destruction method.
Rewritable Media Considerations
Rewritable optical media (CD-RW, DVD-RW, BD-RE) can be erased and rewritten. However, as noted above, erasing a rewritable disc through the operating system does not guarantee that all previous data is unrecoverable. The physical changes made to the recording layer during previous write operations may leave traces that could potentially be recovered.
For rewritable media that contained sensitive data, physical destruction is recommended rather than relying on software-based erasure.
Optical media may be declining in use, but existing stocks in most organisations still hold data that requires proper destruction. A simple collection and destruction process addresses this risk without significant cost or complexity.