Welcome back to Computer History Wednesdays. Today, the small silver disc that rewrote the economics of software distribution, made the multimedia PC possible, and taught the industry its first mass lesson in physical-media malware: the CD-ROM.
In 1982, a 20 MB hard drive was a serious piece of kit. 650 MB on a disc you could mail in an envelope looked absurd. Nobody knew what to fill it with. Within a decade the drive was standard equipment in every home PC, shipping operating systems, encyclopedias, flight simulators with photographic scenery, and Myst. A decade after that it was mostly gone, replaced by DVD, then USB sticks, then the download link.
This post traces the CD-ROM across five phases, works through the security lessons it produced, digs into the physics and error correction underneath it, and finishes with the trivia the format picked up over its 25-year run.
History#
Phase 1: The dawn of optical storage (1970s-1982)#
The CD-ROM started in consumer entertainment, not computing. In the late 1970s a wave of laser-based storage experiments were all chasing the same prize: whatever came after vinyl and VHS.
The videodisc wars came first. MCA and Philips developed LaserDisc, a 12-inch optical format that held 30 to 60 minutes of analog video per side depending on how it was encoded. LaserDisc lost the home video fight to VHS, but it proved that a laser reading microscopic pits off a reflective surface could survive as a commercial product.
The audio industry, meanwhile, was running into the limits of analog recording. Philips and Sony engineers, at first working separately, converged on similar approaches to digital audio storage. The collaboration produced the Red Book in 1980, which defined Compact Disc Digital Audio (CD-DA): the disc dimensions, the 780 nm laser wavelength, the 44.1 kHz sampling rate, and how the audio was encoded onto the disc.
The Red Book’s real achievement was error correction. Cross-Interleaved Reed-Solomon Coding (CIRC) let the format recover from a surprising amount of surface damage, and that is what made the consumer product viable. Vinyl degraded a little with every play. A CD kept working through scratches and fingerprints that would have ruined an LP.
The Compact Disc launched commercially in 1982. Sony’s CDP-101 (October 1982 in Japan, spring 1983 elsewhere) and Philips’s CD100 brought digital audio into living rooms. The 74-minute capacity comes with an origin story that gets retold constantly: Sony president Norio Ohga insisted the disc had to hold Beethoven’s Ninth Symphony. Kees Schouhamer Immink, one of the format’s original engineers, has said the truth is more prosaic (74 minutes was what fit the 12 cm disc size Philips and Sony had already settled on for other reasons), but the Beethoven story is the one people remember.
Computer people noticed immediately. 650 MB against a 1.44 MB floppy wasn’t an incremental improvement; it was a different category of thing. But turning an audio format into a data format meant solving problems the Red Book never had to care about: file systems, error handling that couldn’t just interpolate over a bad sample, and some way of plugging the drive into a computer that had never heard of it.
Phase 2: From audio to data, the birth of CD-ROM (1983-1988)#
Audio can tolerate a bad sample patched from its neighbors. A file byte cannot. Everything about adapting the CD for data flowed from that difference.
Kees Schouhamer Immink at Philips had already developed Eight-to-Fourteen Modulation (EFM), the channel code that made the audio CD possible. EFM turns each 8-bit byte into a 14-bit pattern designed to survive manufacturing defects and disc damage, with merging bits that prevent long runs without a transition. CD-ROM inherited it unchanged.
The Yellow Book (drafted by Philips and Sony in 1983, later standardized as ISO/IEC 10149 in 1989) extended the Red Book for computer data. It kept backward compatibility with CD-DA and added two sector layouts: Mode 1, with an extra layer of error detection and correction for data that has to be exact, and Mode 2, which skips that layer to fit more payload for audio and video that can tolerate the occasional error. Yellow Book is the foundation every CD-ROM was built on.
The first drives arrived in the mid-1980s. Philips’s CM100, released in July 1985 at $1,495, is usually cited as the first commercially available CD-ROM drive. The early market was specialized: medical imaging, industrial design, library reference. Prices ran into the thousands of dollars, and each drive typically came with its own proprietary interface card. Data rates started at 150 KB/s, the “1x” that every later speed rating was measured against.
Microsoft’s MSCDEX (MS-DOS CD-ROM Extensions), released in December 1986, was the software piece that made CD-ROM practical on PCs. MSCDEX let DOS treat a CD-ROM as a mounted drive letter, so existing DOS software could read files off a disc without modification. That one shim is what made the medium usable for mass software distribution.
The first titles were reference works. Grolier’s Electronic Encyclopedia (1985) is usually cited as the first commercial CD-ROM title, carrying the full text of the Academic American Encyclopedia. Reference material was the obvious first application. The capacity and search performance suited it, and users would put up with slow load times to get a whole encyclopedia on one disc.
By the late 1980s prices had fallen from thousands of dollars to hundreds, and drives shipped for IBM compatibles, the Macintosh, and assorted Unix workstations. The pieces for a standard PC component were all in place.
Phase 3: The multimedia boom (1989-1995)#
The early 1990s were when the CD-ROM stopped being a specialty peripheral and became something you expected in a new PC. The Multimedia PC (MPC) marketing consortium published its Level 1 spec in 1991: a 386SX at 16 MHz, 2 MB of RAM, VGA graphics, a sound card, and a CD-ROM drive capable of 150 KB/s. The MPC sticker gave consumers a baseline they could trust and gave software developers a target they could build for.
Developers filled the capacity. Encyclopedias moved to disc: Microsoft Bookshelf, Grolier’s, and then Microsoft Encarta (launched 1993) changed what a home reference work could be. They were searchable, hyperlinked, and carried images and audio clips, which put them in a different category from any print encyclopedia.
Games were the proving ground. Myst (1993) sold over 6 million copies and became the format’s killer app, with plenty of people buying a CD-ROM drive specifically to run it. The 7th Guest (1993) showed that a game built around full-motion video could work as something you played rather than watched. Neither would have fit on floppies, and both changed what mainstream PC gaming looked like.
Educational software followed. Where in the World is Carmen Sandiego? Deluxe got a 1992 CD-ROM edition with digitized National Geographic photos and music from Smithsonian Folkways. Oregon Trail II (1995) brought multimedia to a title that had been a floppy-disk classroom fixture for years. Medical imaging software, legal research databases (Westlaw and LexisNexis both shipped CD-ROM editions), and scientific visualization tools all moved to the disc for the same reason.
Recordable media turned the CD from a read-only distribution format into something users could write. Taiyo Yuden demonstrated CD-R as early as 1988, consumer-priced burners showed up in the early 1990s, and prices kept falling through the decade. CD-RW (rewritable) followed in 1997. The Orange Book series codified the recordable formats: Parts I and II (1990) covered magneto-optical and CD-R, and Part III (1996) covered CD-RW.
Phase 4: Peak performance and market dominance (1996-2000)#
By the second half of the decade the basic technology was settled, and the competition shifted to speed, price, and new markets.
Read speed drove much of it. 1x (150 KB/s) had been the baseline; 2x drives appeared in 1992, 4x in 1993, and by 1996 12x drives were common. By the end of the decade 48x and 52x were commodity parts. Those speeds forced a change in how the disc spun. Early drives used Constant Linear Velocity (CLV), varying the motor speed so the track always passed the laser at the same rate. Pure CLV at 50x would have meant spinning the inner tracks at speeds the plastic couldn’t take, so high-speed drives switched to Constant Angular Velocity (CAV) or zoned hybrids. Discs did occasionally shatter in high-speed drives anyway, usually ones already cracked near the hub.
CD-ROM also spread beyond the PC. The Sony PlayStation (December 1994 in Japan, September 1995 in North America) and the Sega Saturn (November 1994 in Japan, May 1995 in North America) built their entire generation around the disc, using the capacity for cinematic content a cartridge couldn’t hold. Set-top boxes, karaoke machines, and multimedia kiosks brought the drive to people who never thought of themselves as computer users.
Software distribution consolidated on the format. Windows 95, Windows NT, Mac OS, Office, Photoshop: all of it shipped on one or two discs instead of the dozen-plus floppies they would otherwise have needed. That changed the business. Developers could ship larger applications without worrying about media cost, and users stopped spending 40 minutes swapping floppies to install a word processor.
Drive makers competed hard. Plextor, Yamaha, Hewlett-Packard, Teac, and Sony fought over buffer size, access time, and burn quality. Buffer underrun protection (Sanyo’s BURN-Proof, announced in 1999 and shipping in drives by 2000) more or less ended the coaster problem that had plagued CD-R burning for most of the decade.
Phase 5: Legacy and transition to new technologies (2001-present)#
DVD arrived in Japan in 1996 and the United States in 1997, with 4.7 GB on a single layer or 8.5 GB on two against the CD-ROM’s 650 MB. By the early 2000s DVD drives were standard in new PCs. The detail that mattered was backward compatibility: a DVD drive read every CD. Nobody had to give up CD-ROM support to get DVD, so CD-ROM stopped being a distinct product and became the low end of what the DVD drive could read.
USB flash drives and external hard disks did the rest. Solid-state and magnetic storage was faster, smaller, and rewritable without the wear characteristics of optical media. By the mid-2000s most software distribution had moved to downloads, and physical media of any kind was becoming the exception.
The CD-ROM hangs on in a few places. Older car entertainment systems, industrial control systems, embedded devices that take maintenance updates from a disc, and archival storage still use the drives. Decades of maturation made the technology reliable in ways newer, faster media hadn’t yet matched, and where reliability beats speed and capacity, the disc still shows up.
Its most durable technical legacy is standards. ISO 9660 as a file system, UDF (Universal Disk Format) as its successor, and the physical formats developed for CD-ROM all carried forward into DVD, HD DVD, and Blu-ray. The optical lineage the CD-ROM founded is still active in Blu-ray and Ultra HD Blu-ray, even as those formats fade against streaming.
Cybersecurity#
The CD-ROM changed the security picture of the 1990s in both directions. It shrank an old problem (boot-sector viruses riding on floppies had far fewer floppies to ride on once software stopped shipping on them) and opened several new ones. A lot of what came later in physical-media security traces back to lessons the industry learned on this disc.
The autorun era#
The most notorious CD-ROM security problem was Windows AutoRun, introduced in Windows 95 and carried forward through Windows XP. AutoRun launched a program off inserted media without asking, which made it a zero-click infection vector.
The mechanism was simple. Windows read autorun.inf from the disc root, which named an executable, and ran it. Attackers pressed discs that looked legitimate (labeled “Software Update” or “Driver Installation”) and carried malware that ran the moment the tray closed.
What made it dangerous was that the victim did nothing except insert the disc. Once running, the payload could install a backdoor, pull down additional stages, spread through network shares, or escalate privileges, all before the user had seen a single prompt.
AutoRun malware got common enough that researchers documented hundreds of families using the vector. The problem then migrated to USB when Windows XP extended AutoRun to removable drives, which is a large part of how Conficker (2008-2009) spread so effectively. Stuxnet usually gets lumped in here too, and its 2009 variant did carry an autorun.inf, but the 2010 version that crossed the air gap into Iranian enrichment facilities used a different trick: a Windows shortcut parsing flaw (CVE-2010-2568) that fired the moment Explorer rendered the drive’s icons, with no autorun involved. Microsoft disabled AutoRun for USB drives by default in Windows 7 (2009) and pushed the same change to XP and Vista through Windows Update in February 2011. AutoRun for optical discs survived longer, which is why old CD-based attacks kept working on otherwise patched systems for years.
Bootable media and rootkit precursors#
Once BIOSes could boot from CD (the El Torito specification from Phoenix and IBM standardized it in 1995), the disc became a way to run code before the operating system loaded. Malware on a bootable disc got to execute before any antivirus, persist across reboots for as long as the disc stayed in the drive, hide from scanners that only ran after boot, and spread through physical distribution.
These attacks worked because plenty of machines were configured to try the optical drive before the hard disk. An infected disc could own the system before any security software was in memory, which made detection a real problem. The pattern came back much later with UEFI bootkits, though the mechanisms differ significantly.
Software piracy and malware distribution#
Capacity changed piracy. A $500 professional package that had been a stack of floppies became a single CD-R, and pirated discs became one of the most common malware distribution channels of the era. The warez scene’s discs frequently carried trojans hidden in cracked executables, backdoors planted during the cracking process, keyloggers that harvested activation keys, and, later, early ransomware.
The economics were straightforward. The user who installed a cracked copy of a $500 package was handing the attacker exactly the elevated privileges a full compromise needed, and doing it on purpose. The anti-piracy warnings of the era were sometimes overblown, but the malware risk on pirated discs was real.
Supply chain attacks and CD-ROM compromise#
The CD-ROM also produced a physical version of what we now call a supply chain attack. An attacker could intercept a legitimate software shipment and swap in tampered discs, compromise a duplication facility, insert malware during mastering, or press counterfeit discs that were visually indistinguishable from the real product.
These attacks hit end users, small businesses, and corporate deployments alike. The lessons about verifying media (integrity hashes, code signing, tamper-evident packaging) carried straight into the modern supply chain conversation around SolarWinds, XZ Utils, and Kaseya.
Legacy CD-ROM security in modern systems#
CD-ROM security problems persist wherever the technology persists. Legacy systems in critical infrastructure, industrial control networks, and embedded devices still take software updates from a disc. Those systems often run operating systems old enough that none of the modern mitigations exist, which leaves them open to malicious media, supply chain tampering during maintenance, and data exfiltration by anyone with a burner and a few minutes alone with the box.
From optical media to physical media attacks#
The CD-ROM era taught attackers to treat physical media as an attack surface, and the lessons kept evolving. USB attacks (the Rubber Ducky, BadUSB, malicious cables) inherited the physical-insertion pattern. Malicious firmware on peripherals extended it to permanent compromise. Supply chain attacks on hardware distribution scaled the tampering pattern up. And physical access attacks using bootable media (live USB sticks, PXE boot) carried the CD-boot pattern into the modern era.
Defense strategies and lessons learned#
The CD-ROM era drove several defensive practices that outlived the medium.
Autorun disabling and policy controls#
Administrators learned to disable AutoRun through Group Policy and the registry. This was one of the first widespread examples of an enterprise overriding a user-experience default for security reasons, a move that would become routine.
Digital signatures and code verification#
Tampered discs accelerated the adoption of code signing. Microsoft’s Authenticode (1996) let publishers sign executables, and Windows started warning users about unsigned software. That is the direct ancestor of modern supply chain integrity mechanisms.
Media sanitization and handling procedures#
Organizations developed procedures for external media: visual inspection, hash verification, controlled insertion environments, and quarantine for anything suspicious. The same procedures apply, almost unchanged, to USB sticks today.
Modern parallels and contemporary threats#
USB and external media attacks#
Keystroke-injection devices like the USB Rubber Ducky (Hak5, 2010) and the BadUSB class of reprogrammed controllers (SRLabs, 2014), both of which enumerate as keyboards and type whatever payload they carry, are the autorun problem in a new shell. The user interaction required is minimal, and the payload can be anything.
Supply chain compromises#
SolarWinds (2020), Kaseya (2021), 3CX (2023), XZ Utils (2024), and similar incidents showed that trusting third-party software distribution is still an unsolved problem. The CD-ROM era’s tampered discs were an early version of the same thing.
Physical media in air-gapped systems#
Air-gapped systems still face CD-ROM-shaped risks. Maintenance procedures that require inserting physical media (OS updates, configuration files, diagnostic tools) create exactly the same attack surface, and Stuxnet remains the archetypal example of what happens when someone exploits it.
The human factor#
CD-ROM attacks made it impossible to ignore user psychology in security. Physical-media social engineering ran on curiosity (people picking up and inserting found discs), authority (official-looking installers from a claimed vendor), urgency (fake critical updates), and trust (media from a known source).
The “found USB drive” experiment that researchers periodically rerun (scatter drives across a campus or parking lot, count how many get plugged in) is a direct heir of the CD-ROM social engineering era. The 2016 University of Illinois study dropped 297 drives and saw nearly all of them picked up and close to half plugged in with a file opened, and the results have been depressingly consistent since.
Regulatory and industry responses#
The CD-ROM era fed into the development of information security standards. ISO/IEC 17799 (published 2000, derived from British Standard BS 7799 Part 1) established information security management practices including media handling. The lineage split later: 17799 was renumbered ISO/IEC 27002 (the controls catalog) in 2007, while the separate BS 7799 Part 2 (the certifiable management-system standard) became ISO/IEC 27001 in October 2005. Together they form the core of the ISO/IEC 27000 series.
Industry best practices#
Security organizations codified secure media handling: chain of custody, tamper-evident packaging, verification protocols, and destruction procedures for sensitive media. Anyone handling backup tapes, forensic images, or physical evidence still works from the same playbook.
Lessons for modern cybersecurity professionals#
The lessons have aged well. Features built for convenience create attack surface, and AutoRun is the canonical example: it existed to make installing software easier and became a mass malware vector. The integrity of the distribution channel matters as much as the endpoint does, which the industry keeps relearning every few years with a new vendor’s name attached. Physical access never stopped being a problem; the vector just changed from a disc to a USB stick to a hardware keylogger to an implant. No single mitigation covered every path then, and none does now, which is the practical argument for defense in depth. Humans remained the softest target throughout, so training people to recognize and report suspicious media has been part of the job since the first fake driver disc. And old technology lives on in critical systems long after the vendor stops caring about it, so understanding yesterday’s vulnerabilities is how you secure the legacy environment someone will eventually hand you.
Technical tidbits#
The CD-ROM’s engineering combined precision optics, coding theory, and materials science, and it repays close attention.
Optical physics and data encoding#
Spiral track geometry. The data track is a single continuous spiral running from near the center of the disc to the edge, a little over 5 kilometers long. The pitch between windings is 1.6 micrometers, which requires manufacturing precision measured in fractions of a micrometer.
Constant Linear Velocity (CLV). Early drives used CLV to maintain a consistent data rate. The disc spins faster for inner tracks (around 500 RPM at 1x) and slower for outer tracks (around 200 RPM), keeping linear velocity at roughly 1.2 to 1.4 m/s past the laser. High-speed drives switched to Constant Angular Velocity or zoned CLV because pure CLV at 12x and beyond was mechanically impractical.
Eight-to-Fourteen Modulation (EFM). Each 8-bit byte becomes a 14-bit channel pattern, with three merging bits after every symbol to prevent long runs without a transition. The guaranteed transitions are what let the drive recover a clock from the data stream.
Frame structure and synchronization. Each CD frame carries 24 bytes of user data, 8 bytes of CIRC parity, and one byte of subcode (control and display) data, preceded by a 24-bit sync pattern that lets the drive keep lock on the spiral through disc imperfections. After EFM and merging bits, a frame is 588 channel bits.
Error correction and reliability#
Cross-Interleaved Reed-Solomon Coding (CIRC). Two layers of Reed-Solomon error correction with interleaving between them. The interleaving spreads a burst error (a long scratch, a dust particle) across many codewords, turning one long error into many short ones that Reed-Solomon can correct. CIRC can recover data through significant surface damage.
Interpolation and concealment (audio only). When CIRC can’t correct an error in audio data, the player interpolates between neighboring samples to hide it. That’s fine for music and unacceptable for a file, which is exactly why CD-ROM Mode 1 adds its own error detection and correction layer on top: 288 bytes of EDC and ECC per 2352-byte sector, leaving 2048 bytes of user data.
Non-Return-to-Zero Inverted (NRZI) encoding. Data is recorded as pit-to-land and land-to-pit transitions. A transition is a binary 1; no transition is a 0. Combined with EFM’s run-length limits, this keeps timing recovery reliable.
Subcode channels. Alongside the main data, each frame carries eight subcode channels labeled P through W. P marks track boundaries, Q carries timing and position, and R through W support features like CD-TEXT and copy protection metadata.
File systems and data organization#
ISO 9660. ISO 9660 (1988, descended from the 1986 High Sierra format) organizes a disc into volume descriptors, path tables, and directory records with file extents. Directory entries use a fixed format with filename limits (8.3 uppercase in the strictest level, relaxed in later levels) so that any platform could read any disc.
Rock Ridge and Joliet extensions. Rock Ridge adds Unix-style permissions and long filenames for Unix systems. Joliet (Microsoft, 1995) adds Unicode filenames and deeper directory trees for Windows. Both sit on top of plain ISO 9660, so a system that understands neither still gets a readable disc.
Multi-session support. Orange Book Part II defined multi-session discs, where additional data is written in separate sessions, each with its own lead-in, program area, and lead-out. Packet writing (small increments instead of whole sessions) let a CD-R behave like a slow rewritable drive, at the cost of a large chunk of usable capacity.
Manufacturing and materials science#
Injection molding. Pressed CD-ROMs are made by injecting molten polycarbonate against a nickel stamper that carries the pit pattern. The pits are fractions of a micrometer across, which means clean-room manufacturing.
Reflective layer. The aluminum layer is only 50 to 100 nanometers thick, applied by vacuum deposition, and has to be uniform across the whole disc for consistent reflection. Archival “gold” discs substitute gold for aluminum to avoid corrosion over long storage.
Protective lacquer and labeling. A thin lacquer protects the aluminum from oxidation, and screen-printed labels on top of it must not damage the metal underneath. On a pressed CD the data layer sits just under the label side, which is why a deep scratch on the label can be worse than one on the clear side. The polycarbonate substrate provides the mechanical strength and stays transparent to the 780 nm laser.
Performance characteristics and limitations#
Seek time mechanics. Drives position the optical head with a stepper motor or linear actuator. Average seek times ran 100 to 300 ms, much slower than hard drives of the same era, because the head has to reacquire focus on the spiral and (under CLV) the motor has to change speed for the new radius.
Buffer management. A CD-R burner that runs out of data mid-write produces a coaster. Sanyo’s BURN-Proof (2000) solved that by letting the drive pause the burn mid-track and pick up where it left off once the buffer refilled.
Wobble groove (recordable media). CD-R and CD-RW blanks carry a pre-molded spiral groove with a slight sinusoidal wobble. The wobble encodes absolute time in pregroove (ATIP) information that the burner uses to control motor speed and know where it is on an otherwise blank disc. Pressed CD-ROMs have no groove at all; the drive gets its timing from the pit data itself.
Thermal expansion. The polycarbonate substrate expands and contracts with temperature, which shifts track positions slightly. Drives compensate with focus and tracking servos that lock onto the actual disc at spin-up rather than assuming a fixed geometry.
Advanced features and variants#
CD-Extra (Enhanced CD). A multi-session format defined by the Blue Book: audio tracks in the first session, where a standard CD player finds them, and computer data in a second session that only a CD-ROM drive reads. This is how “enhanced” music CDs carried videos and software without confusing a car stereo.
Video CD (VCD) and Super Video CD (SVCD). These extended the CD-ROM for video using MPEG-1 (VCD) or MPEG-2 (SVCD). A standard VCD holds about 74 minutes of VHS-quality video. VCD was enormously popular across Asia before DVD took over.
Copy protection mechanisms. Early CD-ROM copy protection included deliberately corrupted sectors that a legitimate drive could tolerate but a casual copy couldn’t reproduce, and various schemes that exploited differences in how drives report low-level errors. All of it was eventually defeated.
CD-ROM XA (Extended Architecture). XA allowed audio, video, and computer data to be interleaved within a single track, so a program could stream sound while reading data. It used ADPCM compression for that audio, which is lower quality than CD-DA but small enough to share the data stream.
Legacy and modern relevance#
Backward compatibility. CD-ROM drives were designed to play CD-DA discs, so the new technology never made anyone’s record collection obsolete. Every later optical format copied that model.
Error rate specifications. The raw bit error rate off a disc is on the order of 10^-5 before correction and around 10^-12 after CIRC and the Mode 1 layer. In practice a properly manufactured CD-ROM under continuous read should hit one uncorrectable error every several years.
Holographic storage descendants. Research into optical storage fed into experiments with holographic and other volume-based optical technologies. None reached commercial success at scale, but the work informed later optical generations.
Features measured in nanometers, held to tolerance across factories on every continent, all so a kid in 1996 could install Encarta. The engineering was wildly out of proportion to most of what ran on it, and that mismatch is part of why the format lasted as long as it did.
Trivia#
25 stories from the CD-ROM’s 25-year run:
First commercial CD-ROM title. Grolier’s Electronic Encyclopedia (1985) is usually cited as the first commercially available CD-ROM software, carrying the full text of the Academic American Encyclopedia. Initial pricing was around $199, though the drive to run it cost thousands more.
First CD-ROM game for home computers. The Manhole’s CD-ROM version (1989), developed by Cyan (before it became Cyan Worlds) and published by Mediagenic (Activision’s name from 1988 to 1992), is generally credited as the first game shipped on CD-ROM for a home computer; it ran on the Macintosh first. Its surreal, wander-anywhere underground world previewed the environmental storytelling Cyan would perfect with Myst. Japan’s PC Engine CD-ROM² add-on had been shipping games on the format since December 1988, so The Manhole holds the computer title rather than the absolute one.
Myst’s cultural moment. Released in 1993, Myst sold over 6 million copies and drove a huge share of CD-ROM drive sales. Its pre-rendered graphics and non-linear puzzle structure defined the CD-ROM adventure game and became a touchstone of 1990s computing.
AOL’s CD-ROM empire. At its peak in the late 1990s and early 2000s, AOL mailed and gave away hundreds of millions of discs carrying its software and a free-trial offer. Jan Brandt, AOL’s marketing chief at the time, later claimed that at one point half the CDs produced worldwide had an AOL logo on them. The discs became a running joke, a coaster, and eventually a collectible.
Microsoft Encarta’s arc. Launched in 1993, Encarta was the multimedia encyclopedia for a generation of students. Microsoft discontinued it in 2009, unable to compete with free online alternatives, Wikipedia above all.
Promotional disc formats. The CD’s physical format got stretched for marketing. The documented variant went small rather than large: 8 cm mini CDs (about 180 MB) and, from around 1998, rectangular “business card” discs holding 30 to 100 MB that worked in any tray-loading drive. Companies handed them out at trade shows with a catalog, an annual report, or a demo on them. They were functional, cheap to press, and almost never got inserted.
Enhanced CDs and multimedia albums. The enhanced-CD format (audio tracks plus a computer-readable data session) let bands bundle extras. Late-1990s and early-2000s examples carried interviews, music videos, screensavers, and interactive artwork on the data portion. The format was common through the peak CD years until internet distribution made bundling multimedia into a physical release pointless.
Caddy system controversy. Some early drives required the disc to be loaded into a protective plastic caddy first. The caddies were meant to prevent scratches, and users hated the extra step enough that tray loaders took over within a couple of years.
Gaming console adoption. The Sega Saturn and Sony PlayStation (both 1994 in Japan, 1995 in North America) built their generation around CD-ROM, offering far more storage than cartridges and making cinematic game design possible.
The DIVX disaster. Circuit City’s DIVX format (test-marketed from June 1998, discontinued June 1999, not to be confused with the DivX video codec) tried to combine DVD media with pay-per-view rental economics. Players started around $499, discs sold cheaply with a 48-hour viewing window, and watching again required a phone-home charge. Consumers rejected it in about a year and Circuit City took a $114 million after-tax loss. It remains a case study in how heavy-handed DRM drives away the buyers it depends on.
Speed rating wars. The “x” multiplier system turned into a marketing arms race. Plextor and Yamaha traded speed leads for years, and Kenwood briefly sold a 72x drive that read seven tracks at once. By the end of the decade 48x and 52x drives were commodities selling for a small fraction of what a first-generation drive had cost.
Flight Simulator’s medium shift. Microsoft Flight Simulator moved to CD-ROM with version 5.1 (1995), which used the capacity for far more scenery data than the floppy-only 5.0 could carry. It was one of the earlier mainstream products that effectively couldn’t ship on floppy anymore.
Medical imaging. CD-ROM gave hospitals a portable, standardized way to store and share high-resolution scans. DICOM on CD became a working part of telemedicine, second-opinion consultations, and patient-carried records, and plenty of imaging departments still hand patients a disc on the way out.
NASA’s CD-ROM archives. JPL’s Planetary Data System published “Voyagers to the Outer Planets” on CD-ROM in 1989, an eight-volume set that became the template for the Magellan Venus archives that followed. Many of those discs remain readable and online, having outlived the tape they replaced.
CD-ROM art. Artists used the format for interactive work that couldn’t exist in other media. Laurie Anderson’s Puppet Motel (1995, with Hsin-Chien Huang), Chris Marker’s Immemory (1997), and Peter Gabriel’s Xplora1 (1993) are the best-known examples, and Ars Electronica exhibited a steady stream of CD-ROM pieces through the decade.
Patent disputes. Philips and Sony licensed the Orange Book CD-R/RW patents as a pool, and the licensing fights outlasted the format. The best known is Princo v. ITC, where a Taiwanese disc maker stopped paying royalties, argued the pool was patent misuse, and lost in a 2010 en banc Federal Circuit decision that narrowed the misuse defense for every patent pool after it.
CD-ROM kiosks. Mall, airport, and museum kiosks ran interactive encyclopedias, travel planners, and educational content off local discs. Many were CD-ROM based simply because internet access in a public location was still expensive and unreliable.
The first e-reader ran on CD-ROM. Sony’s Data Discman (Japan 1990, US 1991) was a handheld player for 8 cm “Electronic Book” discs holding 200 MB, around 100,000 pages of text, with a 30-by-10 character LCD and a tiny keyboard. It shipped with encyclopedias and travel dictionaries, sold 90,000 units in Japan in its first eight months, and went nowhere in the West. Every e-reader since is a descendant.
CD players for DJs. The mid-1990s brought CD playback into the DJ booth, with Pioneer’s CDJ-500 (1994) offering instant cueing and pitch control that made a CD deck usable in a live set. It changed how electronic music got played out.
Library automation. Academic and public libraries adopted CD-ROM databases for cataloging and research. Services like Dialog and LexisNexis shipped searchable databases on subscription discs, years before the same tools moved online. Some rural libraries still receive updates on CD-ROM.
CD-ROM as BBS content distribution. Some BBS operators moved to CD-ROM distribution, mailing discs full of software collections and message archives to users stuck on slow dial-up. Shareware CD collections became their own commercial category.
Scientific research archives. Research institutions used CD-ROM for long-term data archiving. Its durability made it suitable for climate data, genetic research, and astronomical observations, though modern archival practice has moved to redundant hard disk storage and cloud replication.
Copy protection games. Game developers tried everything from requiring the original disc in the drive to elaborate schemes built on deliberately corrupted sectors. All of it was eventually cracked, but the cat-and-mouse drove innovation on both sides.
Educational software boom. CD-ROM helped build a major educational software market by the late 1990s. Where in the World is Carmen Sandiego? Deluxe (1992), Oregon Trail II (1995), and Reader Rabbit became classroom staples. Many had floppy-only earlier editions and gained their multimedia depth with the CD release.
Legacy in modern computing. ISO 9660, UDF, and the autorun-manifest concept all trace back to CD-ROM. Modern USB auto-mounting descends from the same mechanisms and inherits some of the same security lessons.
Human and cultural impact#
Beyond the engineering, the CD-ROM changed how a generation of people related to computers. Capacity made things possible that had been locked up in research labs, and the price point meant ordinary households got them.
Democratization of multimedia#
The CD-ROM brought high-quality multimedia to the home PC. Before it, that kind of content lived on research workstations and specialized hardware. Myst and The 7th Guest built immersive experiences that stood up next to arcade games, and educational titles made learning something you did by poking at a screen.
It also opened a new medium for digital art. Artists and designers experimented with hypermedia, non-linear storytelling, and interactive installations. Some of the work from that period simply can’t exist in another format, which is its own preservation problem now.
Global digital divide#
The CD-ROM advanced computing in wealthy countries and widened the gap everywhere else. The cost of a drive and a PC capable of running multimedia software kept the format out of reach in much of the developing world, and the split between information-rich and information-poor societies that opened then persists in today’s divides around broadband and mobile connectivity.
Education#
The CD-ROM changed classroom and at-home learning by making multimedia material affordable. Interactive encyclopedias, historical simulations, and scientific visualizations put complex subjects in front of kids in a form paper couldn’t match, and the format suited self-paced exploration.
The obsolescence came fast, though. Schools invested heavily in CD-ROM libraries that became hard to run within a few years as operating systems and drive support moved on. It was an early lesson in the risk of building a curriculum on technology that has a shelf life.
Entertainment industry transformation#
Gaming went through its biggest shift since the arcade era. CD-ROM games offered full-motion video, recorded soundtracks, and branching narratives that cartridges couldn’t hold. The move from games as software to games as produced experiences started here.
Music distribution changed too. Enhanced CDs bundled lyrics, videos, and interviews alongside the audio, an early attempt at the interactive, extras-laden music experience that streaming services would later chase.
Workplace computing evolution#
In the office, the CD-ROM made large software installations and multimedia training materials practical. IT departments distributed software on disc, which pushed them toward centralized deployment methods that eventually became SCCM, Intune, JAMF, and the rest.
It also introduced digital asset management as a concept. Companies started archiving documents, presentations, and training material on CD-ROM, creating the first large-scale digital archives and the first arguments about how to index them.
Privacy and data persistence concerns#
The disc’s durability raised a new kind of privacy problem. Personal data burned to a CD-ROM could outlast the organization that burned it, and there was no way to recall or delete it. That started some of the early conversations about digital permanence that would later feed into data protection regulation and the right to be forgotten.
Environmental impact#
The environmental ledger is mixed. CD-ROM cut paper consumption for documentation and reference works, and it generated a great deal of e-waste. The polycarbonate and aluminum in billions of discs ended up in landfills, and the sheer volume (AOL alone accounted for a startling share) helped raise awareness of electronics waste that eventually informed recycling and materials recovery programs.
Social and generational effects#
The CD-ROM produced a distinct generational experience. People who grew up with a CD-ROM PC developed different expectations of technology than the generation before them: that software should have sound, that a reference work should be searchable, that a computer could be a thing you explored rather than a thing you typed commands into.
It changed the social life of the computer too. Families and friends gathered around the CD-ROM-equipped machine to explore multimedia content together, which looks in hindsight like an early version of the shared screen time that social media later made routine.
Closing#
The CD-ROM took an audio format built for classical music and turned it into the physical substrate of the multimedia PC. It shipped Windows 95, ran Encarta, delivered Myst, and taught the industry its first mass lesson in physical-media malware.
The engineering under it (precision optics, Reed-Solomon coding, cross-platform file systems, an error rate measured in one uncorrectable read per several years of continuous use) is still worth studying as a piece of interdisciplinary design. The security lessons it left behind, autorun as a footgun, bootable media as an OS-level attack surface, physical distribution as a supply chain, map onto most of what came next. And the cultural shift it caused, from a computer as a thing you typed at to a computer as a thing you explored, shaped how millions of people first met digital media.
The medium itself is fading. DVD replaced it, USB and downloads replaced both, and streaming replaced physical media entirely for most people. But the standards, the security patterns, and the design lessons are still working. Every USB drive that auto-mounts, every ISO you burn or loop-mount, every Blu-ray you spin up for cold archival storage traces its lineage through the CD-ROM.
