Old Hard Disk Disposal: RAID Arrays and Encrypted Drives

Introduction

The certificate of data destruction is the operator's primary documentary defense in a post-incident regulatory review. It is also, in our review of vendor profiles across the Compare ITAD directory, the document with the highest variance in what it actually means. When an enterprise IT team disposes of storage assets without understanding the structural differences between drive types, the resulting documentation gap is the failure mode regulators identify first.

Old hard disk disposal — the phrase itself — masks the complexity underneath. A ten-year-old SATA drive pulled from a file server is not the same sanitization problem as a SAS drive extracted from a RAID-6 array, which is not the same problem as a self-encrypting NVMe device with a forgotten key. The sanitization method that works for one may be structurally inadequate for another, and the contract language that covers one may leave the others entirely unaddressed. In our editorial review of ITAD vendor postures, the operators who document drive-type-specific workflows are the minority, not the norm.

NIST SP 800-88 Rev. 2, the current media sanitization standard as of September 2025, defines three sanitization categories: clear, purge, and destroy. The destroy method — disintegration, pulverizing, melting, incineration, shredding — renders target data recovery infeasible using state-of-the-art laboratory techniques. For RAID arrays with unknown stripe configurations, for encrypted drives with lost key material, and for any drive where the organization cannot verify the sanitization method's effectiveness, destroy is the only method that holds up in audit. The question the auditor will ask is not whether the vendor said the data was gone — the question is whether the process you selected was adequate to the drive type you processed.

This guide walks through the prerequisites, the step-by-step disposal workflow, and the troubleshooting steps that address the most common failures we see in enterprise ITAD engagements. For organizations selecting a disposal vendor, the Enterprise Data Destruction Standards for Corporate IT article provides the RFP-level framework that translates these technical requirements into contract language.

Prerequisites

Before you engage an ITAD vendor or attempt disposal internally, you need four things in place: an inventory with serial numbers and storage classifications, a documented understanding of your regulatory exposure, a vendor selection framework that includes audit review, and a chain-of-custody mechanism that survives a regulator's document request.

The inventory is the foundation. You cannot bid disposal work accurately without knowing what you have, where it is, and what data classifications touched each asset. RAID arrays complicate this — a five-disk array is five serialized assets, not one logical volume. Encrypted drives require you to document the encryption method and key-management posture, because the destruction method changes depending on whether you can cryptographically erase or need physical destruction. If your inventory lists "10 servers" without serial numbers, encryption status, or RAID topology, your vendor will either overbid to cover the risk or underbid and cut corners you will not see until the audit.

Vendor Due Diligence

The FTC Disposal Rule at 16 CFR § 682 requires due diligence when you contract with a third party for consumer-information disposal. That due diligence is not a formality — it is the documentary record that shows you acted reasonably. In practice, due diligence means reviewing independent audits of the disposal company's operations, verifying certification by a recognized trade association, and examining the vendor's information security policies before you sign the contract. For enterprise IT teams, this translates to: request the vendor's most recent R2v3 or e-Stewards audit summary, confirm NAID AAA certification if data destruction is in scope, and verify that their contract includes serialized asset tracking and a certificate of destruction that names the destruction method, date, and facility location.

HIPAA-covered entities face an additional layer. 45 CFR § 164.310(d) requires policies and procedures governing the receipt, removal, and movement of hardware and electronic media containing ePHI, plus accountability — meaning a record of the movements and the person responsible. If your organization is subject to HIPAA, your prerequisite checklist includes a documented chain-of-custody process that logs every asset movement from decommissioning through final destruction, and a contract clause that obligates the vendor to maintain that chain and provide it on request.

Knowledge and Documentation

You also need to know the difference between logical and physical destruction, and when each method is appropriate. Older drives with traditional magnetic platters can be overwritten using NIST 800-88 Clear or Purge methods, or physically destroyed through shredding or crushing. RAID arrays require you to destroy all member disks — logical erasure of one disk in a RAID-5 array does not sanitize the data, because the array can reconstruct it from parity. Encrypted drives offer a third option: cryptographic erasure, where you destroy the encryption key rather than the data. But cryptographic erasure is only audit-defensible if you can document the encryption method, the key-management system, and the destruction of the key material. If you cannot produce that documentation, the auditor will treat the drive as if it were never encrypted, and you are back to overwrite or physical destruction.

For a detailed breakdown of what an auditor expects in the certificate of destruction, see Data Destruction Certificate: Key Elements and Auditor Expectations.

Checklist

Before you proceed:

• Inventory every asset by serial number, storage type (HDD, SSD, RAID member), encryption status, and data classification
• Identify your regulatory obligations (FTC Disposal Rule, HIPAA, state breach-notification laws, contractual commitments)
• Request and review independent audit summaries and certifications from any vendor you are considering
• Confirm the vendor's contract includes serialized chain-of-custody, named destruction methods, and a certificate of destruction
• Document your internal chain-of-custody process from decommissioning through vendor handoff
• Verify that your vendor can handle the specific destruction requirements for RAID arrays (all member disks) and encrypted drives (cryptographic erasure with key-destruction documentation, or physical destruction)

Without these prerequisites, you are bidding blind, and the vendor is pricing blind. The result is either an inflated bid that assumes worst-case, or a low bid that cuts the corners you will not discover until the regulatory letter arrives.

Step-by-Step Guide to Hard Disk Disposal

Secure old hard disk disposal requires a documented process that accounts for the underlying technology. The steps below apply across drive types, with specific branching points for RAID arrays and encrypted disks.

Step 1: Inventory and Classify

For RAID arrays, disassemble the array and inventory each physical disk separately. The RAID controller's logical view is not sufficient; regulators and auditors expect serialized tracking for each spindle or SSD.

Step 2: Determine Sanitization Method

Encrypted drives present a decision point. Cryptographic erasure—destruction of the encryption key—can satisfy Purge requirements if the encryption was implemented correctly and the key is irretrievable. If you cannot verify the encryption posture, default to physical destruction.

Step 3: Execute Sanitization

RAID arrays require attention to parity and striping. A single member drive that escapes sanitization can expose the reconstructed array. Process every member drive to the same sanitization level.

Step 4: Generate the Certificate of Data Destruction

If the sanitization was performed by a third-party vendor, the certificate must also document the vendor's certification status and any subcontractor involvement. Undisclosed downstream processing is a documented failure mode.

Step 5: Update Asset Register and Close Chain of Custody

The cheapest vendor is the one whose paper trail you trust enough to hand the auditor without flinching.

Troubleshooting Common Issues in Hard Disk Disposal

The failure modes in old hard disk disposal are predictable. They show up in audit, in discovery, and in the documentary record. The operator who has seen a disposal process fail once knows what to look for the second time.

Drives Transported in Cabinets or Shelves

During the 2016 Morgan Stanley data center decommissioning, hard drives were transported still in their cabinets, with the drives in place. The moving company and the downstream processor both confirmed that the shelves arrived intact, contrary to the operator's own written procedures. The shelves were then sold to another purchaser with the drives still present.

The fix is mechanical: pull every drive, inventory it by serial number, and transport drives separately from the enclosures. The labor cost is real, but the alternative is a chain-of-custody gap that will not survive audit.

Incomplete Erasure on RAID Controller Devices

When data is written to a RAID array, the controller splices it across multiple drives. A standard single-pass overwrite applied to one drive in the array does not reconstruct the data, but it also does not prove that all drives in the array were processed. If the drives are separated before destruction and one drive is missed, the residual data on that drive is still governed by the original retention obligation.

The question the auditor will ask: did you track every drive in the array individually, or did you track the shelf as a unit? If the answer is the shelf, the auditor will ask for serialized proof that every drive was accounted for. If you cannot produce it, the disposal is not defensible.

Vendor Subcontracting Without Documentation

The FTC Disposal Rule requires due diligence when contracting with a third party for destruction of consumer information. Due diligence includes reviewing an independent audit of the disposal company's operations and monitoring compliance with the contract. In practice, many operators discover after the fact that the vendor they contracted with subcontracted the work to a downstream processor, and no audit of that downstream processor exists.

The fix is contract language: require the vendor to disclose all subcontractors in writing before any asset is transferred, and require that every subcontractor carry the same certifications and audit posture as the primary vendor. If the vendor will not commit to that in writing, the contract is not adequate to the risk. For more on the documentary requirements that survive regulatory review, see Data Destruction Certificate: Key Elements and Auditor Expectations.

Encrypted Drives Treated as Sanitized Without Verification

Some operators assume that cryptographic erasure—destruction of the encryption key—is sufficient for an encrypted drive, and that no further physical or logical sanitization is required. The assumption is correct only if the encryption was implemented correctly in the first place, and if the key destruction process is documented and verified.

The failure mode: the drive was encrypted, but the key was stored in firmware or in a separate partition on the same drive. Destroying the key in software does not render the data unrecoverable if the key is still present elsewhere on the device. The operator who relies on cryptographic erasure without verifying the key storage architecture is making an assumption that may not hold up in audit.

Missing Certificates of Destruction

The certificate of data destruction is the operator's primary documentary defense in a post-incident regulatory review. It is also the document with the highest variance in what it actually means. Some vendors issue a certificate that lists only the total weight of material processed, with no serialized inventory. Other vendors issue a certificate that lists every serial number, the destruction method applied, and the date and location of processing.

If the certificate does not list the serial numbers of the drives you sent, it does not prove that your drives were destroyed. It proves that the vendor processed some quantity of material on a given date. That is not the same thing, and the auditor will know the difference.

Conclusion

Old hard disk disposal is not a generic process. The underlying mechanism — RAID striping, full-disk encryption, or legacy magnetic media — determines which destruction methods hold up in audit and which leave you exposed. The operator who treats all drives identically is the operator who ends up explaining to regulators why customer data appeared on an online auction site.

In our editorial review of 35 vendor profiles, the single strongest predictor of audit-defensible documentation is not the vendor's marketing language but the published verification standard they hold. NAID AAA certification, for example, applies to both physical destruction and electronic media destruction, with endorsements that define mobile operations and specific media types like hard drives. That distinction matters when the auditor asks to see the certificate of destruction and the chain-of-custody record.

The FTC Disposal Rule requires policies and procedures that ensure consumer information on electronic media is destroyed or erased so that it cannot practicably be read or reconstructed. That is the floor, not the ceiling. The Morgan Stanley case — where hard drives were sold with data intact because drives were transported in shelves rather than individually tracked — demonstrates what happens when policy and practice diverge. The cumulative cost exceeded $100M, and the documentary record showed a failure at the most basic level: the operator did not follow its own procedures.

For the enterprise IT lead writing the RFP, the question is straightforward: does the vendor's destruction method match the drive type, and does the certificate of destruction document serialized chain-of-custody for the full retention period? If the answer to either question is unclear, the vendor's posture is not adequate to the risk. The cheapest vendor is the one whose paper trail you trust enough to hand the auditor without flinching.

The trade-off is always between convenience and documentary defensibility. RAID arrays require individual drive tracking. Encrypted drives require cryptographic-erasure verification or physical destruction. Older magnetic media may require degaussing or shredding rather than overwrite. The vendor who can articulate those distinctions in the contract language is the vendor whose process will hold up when the auditor reviews the record. For further guidance on structuring vendor contracts and RFP language, see Data Destruction Certificate: Key Elements and Auditor Expectations.