Optical Media Sanitization: Rewritable and Write-Once Discs

Short answer

Identify the exact optical medium before choosing a data-removal method. A write-once disc cannot be converted into rewritable blank stock by deleting files. On rewritable media, a quick erase can remove navigation information while leaving user data recorded. A full erase must still be qualified for the actual medium, recorder and software; its completion is not an automatic release decision for every confidentiality level.

When reuse has no approved value or erase coverage cannot satisfy policy, use a qualified optical-media destruction process. Treat CD, DVD and Blu-ray as distinct inputs. A machine suitable for one is not automatically suitable for the others, and a scratched disc that fails to mount is not a sanitization certificate.

Who this is for

This guide is for authorized ITAD teams, records managers and operators processing removable optical media. It provides a classification and evidence workflow, not a universal burning command. The batch may contain rewritable discs, write-once archives, pressed distribution media and unidentifiable discs; sort them before choosing a tool.

The software example below is the legacy Windows IMAPI IDiscRecorder::Erase interface for CD-RW. It is deliberately restricted to that API's documented medium and behavior. Do not extend it to DVD-RW, DVD-RAM or BD-RE merely because another application also displays an Erase button.

When to use this

Use the workflow when optical media leaves organizational custody, a retention period ends, or reusable media is being reassigned. A mixed archive box needs an intake manifest before it enters a destruction queue. The most useful early decision is often whether reuse is worth qualifying at all.

Obtain the information owner's disposal authority and resolve legal holds first. A second copy on a server does not automatically permit deletion of the disc, and destroying a disc does not remove server, cloud or recipient copies. State which copies this job covers.

When not to use this

Do not proceed if the disc's identity, retention status or media type is unresolved. Quarantine it for classification rather than assuming an unreadable label means low sensitivity.

Do not improvise with microwave ovens, fire, chemicals or hand-breaking. These introduce handling and environmental hazards and do not provide a controlled acceptance process. Use trained operators and equipment intended for the actual media. If treatment requires an outside provider, maintain custody while it is in transit and awaiting processing.

Workflow

1. Classify the recording medium

Read the manufactured media marking and use supported recorder identification where needed. Distinguish pressed read-only media, recordable write-once media and explicitly rewritable media. Record the exact type, not simply “CD” or “DVD.” If identification requires reading customer data, use an authorized isolated workflow and avoid exporting contents into the evidence record.

A handwritten “RW” sticker is not an adequate technology identifier. Likewise, a writable session does not establish that existing recordings can be overwritten. Keep ambiguous media in the exception lane.

For each item, record an internal identifier, available manufacturer/type marking, owner authorization, intended destination and the classification decision. Retain enough information to map the physical disc to its result without exposing customer filenames publicly.

2. Decide whether reuse is an approved outcome

If the medium is write-once or read-only, an ordinary software erase route is unsuitable for removing existing recordings. Select the policy-approved physical disposition. Do not waste processing time cycling through format options that cannot change that storage property.

For rewritable media, require an erase procedure that names the supported type, recorder and software version. If those prerequisites cannot be established, choose a stronger disposition or keep the disc restricted. “Rewritable” describes an ability to change recordings; it does not by itself establish an accepted sanitization method.

Decide the required outcome before running a tool. Otherwise a successful quick operation can become the default simply because it is fast, even when it does not meet the intended scope.

3. Distinguish quick erase from full erase

The legacy Windows CD-RW IDiscRecorder::Erase API uses the Boolean argument bFullErase: false selects quick erase and true selects full erase. Its quick path clears particular disc-management structures, including the first session's table of contents, while user data remains in the program area. Its full path addresses the entire disc. The interface also provides a separate completion notification.

This distinction is an API-specific example, not a recommended invocation for unknown media. A request being accepted is different from receiving final successful completion. Record the selected mode and final result; a screenshot of an empty file browser cannot substitute for either.

For other software or media types, verify the operation's meaning directly. A quick format, filesystem initialization, session closure and full media erase are not interchangeable labels. If the tool does not disclose coverage or returns an unsupported-media error, stop and classify the result as unresolved.

4. Capture completion and handle exceptions

Before starting an irreversible operation, compare the loaded medium with the authorized manifest item. Save the recorder identity, firmware if available, software version, selected operation, relevant settings and timestamps. Keep the terminal error or completion result rather than only a progress-bar photograph.

Power interruption, cancellation, damaged media, an inaccessible recording area or a recorder error requires explicit handling. Do not infer success from a disc ejecting or a formerly visible volume disappearing. Determine whether the supported procedure requires a repeat operation, another compatible recorder or physical disposition.

Read-back, where required by the qualified procedure or policy, must have a stated scope. A normal filesystem mount is only one observation path. Do not turn a failed mount into a claim about every information-bearing layer or every session. Avoid copying sensitive recovered data into an unrestricted verification log.

5. Qualify destruction for the exact media

The NSA/CSS Optical Sanitization Devices list dated October 2026 provides a useful example of media-specific qualification. Its requirements summary distinguishes CDs at a maximum edge size of 5 mm or less from DVDs and Blu-ray discs at 2 mm or less. These are scoped criteria for that equipment list, not universal numerical requirements for every private organization.

Where that framework applies, match the exact equipment model and its listed acceptable material. List inclusion does not guarantee continuing machine performance; maintenance and retesting matter. Do not take a CD-only entry as permission to process DVD or Blu-ray media under the same acceptance claim.

A provider's general “secure shredding” statement is too vague to resolve this question. Ask for the equipment identity, accepted input types, treatment criteria, operating checks and how failed or unprocessed items are isolated. Retain the applicable requirement's title and date in the restricted job record.

6. Close the physical manifest

Reconcile every item with an accepted result or an exception. In an illustrative batch of ten discs, nine accepted destruction results and one rejected input mean one disc remains outstanding. A shipment receipt for ten is not proof that all ten completed treatment.

Keep labels that are needed for traceability controlled until the association with the job record is secure. Remove sensitive markings at the stage required by the approved disposition process. Track fragments, rejected inputs and recovered discs through the final custody handoff; do not close the job just because material entered a hopper.

Verification checklist

• Is each physical disc bound to a manifest identifier and disposal authority?
• Is its recording type identified, including whether it is actually rewritable?
• For software treatment, are supported medium, recorder, version, mode and final status recorded?
• For destruction, does the exact equipment qualification cover the input medium and required outcome?
• Are interruptions, damaged discs and rejected inputs segregated and unresolved counts visible?
• Has a reviewer accepted the evidence for the intended destination?

NIST SP 800-88 Rev. 2, September 2025, makes acceptance depend on more than successful tool execution. A finished process with unsuitable media scope or an unacceptable physical result can still be rejected. Keep the operation record and the confidentiality decision as separate evidence fields.

Verification note: criteria, not a completed disc test

No optical disc was erased, read back or destroyed for this article. The API behavior and dated equipment-list distinction provide the technical examples. A real job needs evidence from the actual recorder or destruction equipment, the actual media type and its applicable acceptance procedure. No laboratory recovery claim or product certification follows from this article.

Resale and evidence checklist

Only return rewritable media to an approved reuse pool after its treatment and acceptance record are complete. Do not describe write-once, unknown or failed media as sanitized blanks. Record the final destination and whether reuse is permitted; an operationally usable disc and an accepted confidentiality outcome are separate facts.

What not to publish

Do not publish disc contents, customer names, filenames, archival labels, restore information or sensitive transport arrangements. Keep identifiable intake photos and full job evidence restricted. A public summary should disclose the process class and honest scope without exposing the information the job is meant to protect.

Common mistakes

Common failures include confusing delete with erase, assuming every optical format is rewritable, accepting a quick CD-RW operation as full coverage, and applying one particle-size statement to every media or policy context. Cosmetic damage and unreadability are especially weak substitutes for a documented process.

Do not call a service provider “NSA-approved” merely because it owns listed equipment. The NSA FAQ distinguishes evaluated equipment from provider selection; the organization remains responsible for vetting the service and its process.

CliDeck workflow fit

A repeatable operator checklist can bind classification, treatment evidence, exceptions and reviewer acceptance to one media record. Keep software logs and physical-destruction records attached to the same disposition job where applicable. This describes an evidence workflow, not a claim that CliDeck supports optical erase commands or certifies destruction hardware.

FAQ

Does an empty file listing show that a disc is sanitized?

No. It shows what that filesystem view exposes. Quick erase may remove navigation information while leaving recordings behind.

Should every organization use the NSA list's dimensions?

Apply the requirements that govern the information and organization. A scoped list is useful evidence, but it is not a substitute for identifying the applicable authority and exact equipment/material match.

What if the media type cannot be identified?

Keep it restricted and record the uncertainty. Do not approve reuse based on a guessed format; select an authorized disposition that resolves the uncertainty.

Related guides

See the media sanitization process, coverage model and its limits, and the distinct magnetic tape disposition workflow.

Most common default

Most network console ports use 9600 8N1, but many modern switches, appliances, and server-management interfaces use 115200. Some devices use other speeds such as 38400, 19200, 57600, or 2400.

Notable exceptions

Examples:

• FortiSwitch often uses 115200.
• HPE Aruba AOS-CX often uses 115200.
• Dell OS10 often uses 115200.
• MikroTik RouterOS commonly uses 115200.
• TP-Link JetStream examples may use 38400.
• F5 BIG-IP may use 19200.
• Some UPS serial protocols may use 2400.

How to use this table

Use the table as a starting point, then verify the setting against the device label, approved device procedure, site runbook, or known-good console output. If the terminal shows unreadable characters, test the likely baud rates before assuming the cable or port is broken.

Verify against the device-specific procedure

Do not treat a reference table as a substitute for the approved device-specific procedure, site policy, or a verified device-specific runbook when the operation is risky.

How CliDeck helps

CliDeck helps teams keep console settings, notes, runbooks, and terminal sessions organized. Console Server Go can show the current UART speed on its built-in screen. Net Controller can help teams process multiple devices with standardized workflows where configured.