A system and method is provided for detecting unauthorized actions with respect to encrypted data on a media disk, the media disk including a first portion for prerecorded content and a second portion for written content. The method includes reading an identifier on the media disk, wherein the identifier includes one or more sections located in one of the first portion for pre-recorded content, the second portion for written content, and both the first portion for pre-recorded content and the second portion for written content, determining whether the identifier includes a section located in the second portion written content, comparing the identifier with one or more predetermined types of identifiers for which a section is located in the second portion for written content, and if the identifier is of a type that is one of the one or more predetermined types of identifiers, detecting an unauthorized action.