Why Decommissioning Needs Drive-Level Inventory
By Ali Hassan, Editor, MAH Recycling
A 2U Dell PowerEdge R740xd can hold up to 32 drives, yet a typical disposal certificate lists it in one line: “1x server destroyed.” An auditor cannot test a drive that was never listed.
That gap is the reason drive-level inventory matters in data centre decommissioning.
Why drive-level inventory beats a chassis count
Dell’s R740xd spec sheet lists up to 24 front 2.5-inch bays plus mid-bay drives. Counting rear bays, a single 2U unit can hold up to 32. The plain R740, according to Dell’s own documentation tops out at 16 front drives and can also carry two M.2 boot SSDs.
So “R740” tells you almost nothing about how many data-bearing devices left your building. A chassis-level record treats the server as the asset. The drives, which hold the data, appear nowhere.
What the standards ask for
NIST publishes a sample certificate of sanitization, and it records manufacturer, model and serial number for the media itself. The Rev. 1 publication page hosts that sample, and Rev. 2 keeps a version of it.
ISO/IEC 27001 works at a higher level. Annex A 5.9 requires an inventory of assets, and A.7.14 requires equipment containing storage media to be verified as cleared before disposal or reuse.
Neither standard says “list all 24 drives.” But both ask you to prove something about the media, and you cannot prove what you never listed.
Chassis-level vs drive-level records
| Question an auditor asks | Chassis-level record | Drive-level record |
|---|---|---|
| Which drives were inside? | Unknown | Listed by serial |
| Was every drive purged or destroyed? | Assumed | Method recorded per drive |
| Did a drive go missing? | Invisible | Flagged at intake |
| How were SAS and NVMe handled? | One line | Method per media type |
| Can I trace a sample? | No | Pick any serial, find its record |
Building a parent-child record
Think of the chassis serial as the parent and each drive serial as a child.
- Before power-down, record the chassis serial and a bay map showing what sits where.
- At de-racking, scan each drive serial and tie it to its parent.
- Count drives into sealed containers and sign the count at the loading-bay handover.
- At intake, reconcile child serials against the pickup list.
- Record the method for each drive, not for the whole box.
- Issue a certificate that lists parent and child serials together.
Remember the media outside the front bays. Mid and rear bays, M.2 boot cards and other onboard storage all count. A bay map built from the front panel misses them.
What about SANs?
Storage arrays are the same problem at larger scale. The array and each shelf serve as parents, while every disk, including hot spares and any cache drives, is a child. A single “SAN disposed” line gives an auditor no way to check the disk count.
When a label is unreadable
Some drives arrive with damaged or missing labels. Record the chassis serial, bay position and a photograph, and note the exception in the certificate. MAH Recycling’s reports list drive counts and, where captured, serial numbers, so legible labels at pickup make the record stronger. Our on-site HDD shredding service covers hard disks that must not leave your premises.
Send your chassis list and bay maps through our data centre decommissioning page for a written scope, or browse all MAH Recycling services.
