Trust
Quick Answer: For corporate HDD or SSD data destruction in the UAE, identify the storage media and sensitivity before choosing sanitisation or physical destruction. SSDs need flash-appropriate methods; magnetic degaussing does not sanitise them. Request asset-level chain of custody, method details, verification and exception reporting under a policy informed by NIST SP 800-88 Revision 2.
A UAE ITAD quotation that promises to 'wipe every drive' without naming media types leaves a critical question unanswered: what method will be used on the actual drives? A magnetic hard disk, NVMe SSD, encrypted laptop and failed storage module have different constraints. NIST published SP 800-88 Revision 2 on 26 September 2025, replacing Revision 1 and emphasizing an enterprise sanitisation programme, risk decisions and verification.
Build a manifest before collection rather than relying only on laptop or server counts. A desktop may contain multiple drives; a NAS can have many disks; a phone or thin laptop can have embedded flash that is not a removable 2.5-inch drive. Record whether the storage is functional, encrypted and intended for reuse.
NIST SP 800-88 Revision 2 frames sanitisation around confidentiality risk and approved organisational controls. Clear is not interchangeable with Purge, and Destroy removes media from reuse. The appropriate choice depends on the sensitivity of information, media characteristics, method support and how completion is verified.
SSDs use flash memory with wear levelling and spare or overprovisioned cells. Overwriting only the logical sectors visible to the operating system may not reach all previous data locations. NIST's revision directs organisations toward appropriate device-aware techniques and standards; it does not endorse a blanket multi-pass overwrite as proof of secure SSD sanitisation.
Degaussing uses a magnetic field and is not an appropriate way to erase flash SSDs. Magnetic HDDs may support different approved methods, but the particular drive and technique still need to be evaluated. Avoid any supplier who proposes the same undifferentiated process for every media type.
Cryptographic erase can be appropriate when data was protected by suitable encryption and the relevant keys can be sanitised with confidence. That conclusion requires understanding whether plaintext was ever written, whether key copies or escrow exist and whether the implementation is trustworthy. Merely seeing 'BitLocker on' or 'encrypted SSD' is not a complete disposal certificate.
A useful quotation separates collection, secure custody, erasure, physical destruction, recycling and reporting rather than hiding them under a single per-unit charge. Ask the vendor to describe how it handles SSDs, HDDs, drives that will not power on and devices that contain embedded storage. The method should be specified before handover, with an agreed path for exceptions.
Do not accept a generic 'all data destroyed' statement without a reconciliation against the manifest. A device count is not the same as a drive count. If a drive fails sanitisation, the record should show a failed outcome and a later approved disposition, not silently count it as successfully erased.
NIST publishes technical guidance; citing SP 800-88 is not evidence that NIST accredited or certified a particular ITAD company. Ask suppliers to substantiate any independent certification or regulatory claim separately, including its scope, validity and issuing body. Rekart's public ITAD page is a route to request an assessment, but the exact available methods, documents and accreditation evidence must be verified before contracting.
For a useful quotation, submit a sample asset manifest and ask the Rekart team to state which storage types, sanitisation methods and exception procedures can actually be supported. This article deliberately makes no unsupported claim of 'NIST certification' or guaranteed regulatory compliance.
No. SSDs use flash storage rather than magnetic recording, so degaussing is not an appropriate sanitisation method. Ask for an SSD-compatible approved technique or physical disposition.
A routine format does not establish an approved sanitisation outcome. Choose the method based on data sensitivity and your policy, then retain verification evidence.
No. Wear levelling and overprovisioned flash can leave locations inaccessible to ordinary host overwrites. Use a suitable media-aware sanitisation process and validate the outcome.
Physical destruction may be appropriate for damaged, untrusted or high-risk media that cannot be acceptably sanitised for reuse. The decision should be documented under the organisation's retention and security policy.
Ask for serial-linked assets, media type, method, processing date, operator and verification result. Reconcile the certificate with the original inventory and a separate exception report.
NIST SP 800-88 is published guidance, not proof that a named supplier holds a NIST-issued certification. Independently verify any actual accreditation or certification claimed by the vendor.
Rekart's ITAD page provides a corporate enquiry route for storage and IT assets. Submit media types, quantities, sensitivity and documentation requirements and obtain written confirmation of available methods and terms.
Next step: Request a media-specific ITAD quotation from Rekart. Confirm eligibility, parts or methods, inspection and written terms before committing.
Rekart editorial team — guides for certified refurbished tech in the UAE.
