Guides
For UAE businesses retiring servers with SSDs or RAID arrays, inventory every physical drive and map it to its host before collection. Deleting a RAID volume is not proof of data sanitisation, and degaussing does not work on flash SSDs. Choose an approved media-specific method, verify results and retain per-drive custody and exception records.
Retiring a server is not the same as retiring a laptop. One chassis may contain RAID members, hot spares, boot SSDs, NVMe modules and removable storage. A statement that the server was reset or the RAID volume deleted does not establish what happened to every physical drive. UAE IT, procurement and compliance teams need a drive-level process before arranging collection or buyback.
A RAID controller can present several physical drives as one logical volume. Deleting that virtual disk or clearing its configuration is a management operation, not proof of sanitisation of the underlying media. Drives removed earlier during maintenance may also contain business information. The inventory must distinguish the chassis, RAID controller, logical volumes, physical drives and any hot spares.
Include boot modules, removable USB media, NVMe cards and any storage in a separate array. Reconcile the physical count against the server's management records before pickup. A missing or failed drive should be listed as an exception, not silently excluded from the final certificate.
NIST SP 800-88 Revision 2, finalised in September 2025, describes a risk-based media sanitisation programme. It is guidance, not a NIST-issued certification for an ITAD company. The organisation should determine an acceptable Clear, Purge or Destroy outcome according to data sensitivity, media characteristics and applicable policy.
Flash SSDs have controller-managed storage and may include overprovisioned or remapped cells that are not directly accessible to ordinary host overwriting. Degaussing does not sanitise flash because the data is not stored magnetically. A supported manufacturer-documented sanitise operation or properly validated cryptographic erase may be appropriate in certain circumstances; failed or unsuitable drives require an approved alternative. Do not assume that every SSD supports the same operation.
Classify magnetic HDDs separately from flash SSDs. A technique applicable to magnetic media may not work on flash. For a mixed RAID server, each physical device needs a documented treatment that matches its technology and the required security outcome. A failed drive is not automatically safe simply because it no longer boots.
Record who released the assets, who collected them, where they were transported and who performed the treatment. Each media record should identify the drive, method, tool or equipment, result, verification and final disposition. The authorised owner should validate whether the result meets the organisation's confidentiality requirement. A certificate without serial numbers or a clear exception process is weak evidence for an audit.
Submit the approved manifest through Rekart's corporate device buyback and ITAD enquiry. The separate IT asset disposition page is also available. Request written confirmation of server-media acceptance, actual treatment capabilities, evidence, any subcontracting and commercial terms; this guide does not establish those services for a particular server or drive.
Only after the confidentiality requirement has been met and documented should equipment be evaluated for reuse, parts recovery or recycling. Do not assume a particular environmental saving or zero-landfill outcome without evidence. If physical media cannot be safely reused, agree on the approved disposition and retain records with the asset register.
Confirm disposal authorisation, legal holds, asset counts, encryption history, data classification, and whether the chosen method can be verified on the actual drives. The strongest process is not the one with the most impressive certificate wording; it is the one that can reconcile every physical medium to a defensible outcome.
No. Removing a logical volume does not prove that underlying physical drives have been sanitised. Track and verify treatment for each medium.
No. Degaussing applies to suitable magnetic storage and does not sanitise flash memory. Choose an approved SSD-specific method or disposition.
Not automatically. Resetting server configuration and sanitising data-bearing drives are different tasks. Require media-specific evidence.
No. SP 800-88 Revision 2 provides sanitisation guidance, not vendor certification. Independently verify any supplier qualifications and treatment evidence.
Record it as an exception and choose an approved alternative treatment. Do not claim a successful wipe without verification.
Yes. Hot spares can contain data from previous activity or rebuilding. Include them in the manifest and treat them according to the actual media type.
Rekart has a corporate ITAD enquiry route, but this guide does not establish server-media acceptance or a specific erasure capability. Provide the detailed manifest and request a written scope and evidence package.
Rekart editorial team — guides for certified refurbished tech in the UAE.
