CD Media Data Destruction

by Gr3y t0qu3  (grey@paladindesign.ca)

While we as hackers have an obsession with freedom of speech we also have an obsession with data destruction.

I wrote this article to quell my - and many other peoples' - interest in the latter specifically dealing with CDs.  "I've heard nuking the CD in a microwave is not 100 percent successful in destroying the data" was stated in "How to Hack From a RAM Disk" in 18:4.  I tried to find information on this topic but there really is none out there, so I decided to take this task on for myself.

When I started doing research for this article I realized that there are many ways to destroy CD-ROM, CD-R, and CD-RW media.  The first things I found were targeted towards commercial uses.  I found products that used "micro indentation" to "reliably penetrate the data surface of target media, destroying any readable data" and as a side effect the CD went from round to an oval shape.  Sure sounds good, right?

Well if you have $5k to waste it's great.  Then there's some that grind away the recording surface.  The one I found cost $10k.  Both of these solutions are not priced for the average person.

Simply deleting the files from a CD-ROM/CD-R/CD-RW won't work either.  There are plenty of software suites out there for recovering data from them.  I found one for $39.95 and there was even a free 30 day trial.  So if you have a low tech adversary you're hiding the data from even that wouldn't work.

The software can also recover data from quick formatted CD-RWs, where the data is left there just to be overwritten at a later time (the same concept as recovering deleted data from your hard drive - the reference to the data in the drive table is removed, the data isn't touched).  Let's get to the main point of the article: Does data destruction with a microwave really work?

First, to understand if the microwave is an effective way to destroy data you need to understand how CDs are made.  All three types of CD (CD-ROM, CD-R, and CD-RW) are different.  In the next little while I'm going to look at the three different types and explore if it will work for each.

CD-ROMs are exactly what they say, CDs with Read-Only Memory (ROM).  Most of a CD-ROM consists of a piece of clear polycarbonate plastic.  During manufacturing, this plastic is impressed with microscopic pits arranged as a single, continuous, extremely long spiral track of data.

Once the plastic is formed, a thin, reflective aluminum layer is "sputtered" onto the disc, covering the bumps.  Then a thin acrylic layer is sprayed over the aluminum to protect it.  A CD reader reads CD-ROMs by sending out a laser beam that passes through the plastic layer, reflects off the aluminum layer and hits a device that detects changes in the amount of light it receives.

The bumps, commonly called pits because if you could see them they would look like pits from the label side of the CD-ROM, reflect the light differently from the lands.  The lands are the rest of the aluminum layer.  The aluminum layer is very, very thin.  When you nuke a disk, large currents flow through the aluminum.  These currents produce enough heat to vaporize the aluminum.  You then see a very small lightning storm as electric arcs go through the vaporized aluminum.  There will be many paths left etched through the aluminum after this.  So with the aluminum vaporized a CD player won't be able to read the data anymore.

Because of the extreme heat of the aluminum the plastic above and below the aluminum would also be damaged.  I'd be guessing the aluminum paths left would be horribly warped.  Just think about what would happen to you if you were subjected to that kind of heat.  I'm fairly confident that this is a 100 percent secure method of data destruction as you would not be able to somehow inject a new reflective material and fill up the microscopic pits as they would be damaged.  Sure, that's all great if you happen to have a Windoze CD sitting around that you don't want anyone to have to experience the horror of.

So what about CD-Rs?  Instead of there being pits imprinted into the plastic of a CD-R there is an extra layer.  This extra layer is a greenish dye right below the reflective material.  A write laser heats up the dye layer enough to make it opaque.  The read laser in a CD player senses the difference between clear dye and opaque dye the same way it senses bumps - it picks up on the difference in reflectivity.  So when you nuke a CD-R the gold/aluminum layer vaporizes.  If that is the only effect then it would be possible to cut the CD where the aluminum/gold layer used to be and then put a reflective substance on top of it and stick it in a CD player.

This would require very, very fine instruments as a CD is only 1.2 mm thick.  But the main variable is how hot the aluminum/gold is when it vaporizes and if it is hot enough to change the state the dye is in - from transparent to making the whole disk opaque to a reader.  From looking at a few nuked CD-Rs I think that most data would be lost.

On a blank CD that is nuked, there is a "loose swirly" pattern of the different shades (written and unwritten), effectively making true data impossible to find.  On CDs with data it would do the same and so a lot of data would be lost.  So on CD-Rs it's not really a guaranteed process of having your data fully and completely removed.  Although if you're up against someone like the NSA/FBI/CIA who are going to all the trouble to find that information you have far bigger problems on your hands and I'm guessing you'd never see a public court.

CD-RWs are a little different again.  Instead of the dye layer there's a phase-change compound composed of silver, indium, antimony, and tellurium.  This recording layer is sandwiched between dielectric layers that draw excess heat from the phase-change layer during the writing process.

A CD-RW drive has to use three different lasers: a read laser, a write laser, and an erase laser.  To write to a CD a laser beam heats areas of the phase-change material above the melting temperature (500-700° C), so all the atoms in this area can move rapidly into a liquid state.  Then, if cooled quickly enough, the random liquid state does not reorder its atoms back into a crystalline state.

To erase, a laser heats the same area to above the crystallization point - 200° C - and then lets it cool quickly so that the atoms reorder themselves.  The read laser is much less powerful.  The dielectric layers that are above and below the phase-change compound are by definition "poor conductors of electricity and will sustain the force of an electric field passing through it."

So that would not allow much of the electric field caused by the microwave to be able to reach the phase-change compound layer where the data is stored.  But then again, it's not made to stand the bombardment by a microwave.  Also, it's a heat insulator so the temperatures caused by the reflective layer vaporizing will not affect it too much either.  So again with advanced tools it might be possible to remove the damaged material and put on a new reflective layer.

Unfortunately I have no way to find this out for sure.  I would like someone to write a followup to this article with actual lab data (university).  As you can see it is not known if microwaving is a 100 percent secure form of data removal for CD-Rs and CD-RWs.

It is one of the most secure options there is.  It should hold up unless you have President of the United States (POTUS) really pissed off at you.  Local police agencies and the FBI probably do not have the technology to retrieve data from a nuked CD.

Most of the people who argue that this is possible also argue that "they" would just go back in time to before you nuked the CD...

Greetz: Spiffy and Sypher.