How Businesses Should Dispose of Hard Drives

1. Build an inventory first

You cannot prove a drive was destroyed if you never recorded it.

• Record serial numbers — or at least asset tags — for every drive or device
• Include drives still inside servers, arrays, laptops, printers and appliances
• Note the data classification of the systems they came from
• Keep drives in locked storage until they leave

2. Decide: reuse, resell or destroy

Your data-handling policy decides this. Many organizations require physical destruction for any drive that held sensitive data. Where equipment will be resold, the drives are commonly removed and destroyed while the rest of the hardware is remarketed — recovering value without putting data at risk.

3. Match the method to the media

Drilling or hammering a drive in-house is inconsistent, can leave recoverable platters or flash chips, and produces no record.

4. Control custody and keep the records

• Sealed containers from your site to the destruction facility
• Signed handoffs at each transfer
• A serial-by-serial destruction log
• A certificate of destruction tied to that log
• Retention of those records per your audit requirements

Choosing a provider

Ask where destruction takes place, which methods are used for each media type, what certifications the provider holds, and to see a sample certificate and log. Be wary of any provider that cannot show serial-level records.