Hard disk drives
Physically destroyed
Each hard disk drive is dismantled at our Mayfield workshop to its components, and the platters are shattered or bent.
3.5-inch and 2.5-inch hard drives
Data security
Secure data destruction, with the records to prove it
Every data-bearing device that comes to us is sanitised in line with NIST SP 800‑88 Rev. 2, inside a documented chain of custody. From the agreement we issue before pickup to the certificate you file afterwards, each step leaves a record. No data is ever viewed or accessed by ITAR.
- NIST SP 800‑88 Rev. 2The standard we sanitise in line with
- 836 devicesData-bearing devices securely sanitised in FY2024/25
- Serialised certificatesPer machine and per drive, on request
The failsafe
Already wiped? Good. We do it again, and put it in writing.
Most organisations wipe their own devices before retiring them, or have their IT provider do it. That's the right first step, and we'd never tell you to skip it.
But a drive that gets missed is how retired equipment turns into a data breach, and a wipe nobody recorded is one you can't prove happened. Under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act must notify affected individuals and the Australian Information Commissioner when a data breach is likely to result in serious harm.
That's where we come in. Whatever has been done before it reaches us, every data-bearing device is logged by serial number and sanitised again by ITAR. You get an independent second pass and, on request, a serialised certificate from someone outside your organisation.
Your team does the wipe. We're the failsafe.
The standard
One standard, two methods
Data destruction is carried out in line with NIST SP 800‑88 Rev. 2. The method depends on the type of drive: hard disk drives are physically destroyed, and solid state drives are sanitised with ATA Secure Erase.
Your data is never viewed or accessed by ITAR at any point. Storage devices are sanitised before equipment is assessed for reuse or recycling.
If you need urgent removal or data destruction, we can arrange it on an as-required basis.
Sanitised in line with
NIST SP 800‑88 Rev. 2
This applies to every data-bearing device we receive.
Methods
How each type of drive is handled
Solid state drives
ATA Secure Erase
Solid state drives are sanitised using ATA Secure Erase, in line with NIST SP 800‑88 Rev. 2.
2.5-inch and M.2 solid state drives
Other media: we also physically destroy optical discs and magnetic tape. Ask us when you get in touch.
Chain of custody
From your site to a certificate, in ITAR's hands only
Your equipment never passes through a courier, a contractor or a public counter. This is what happens to it, step by step.
-
Agreement
Before anything is collected, we issue you our Data Destruction Agreement.
-
Collection
ITAR collects directly; we don't use couriers or third parties. Larger jobs travel in a locked bin and smaller ones in a locked portable safe, in a GPS-tracked vehicle. If you have an asset register or manifest, hand it to us at pickup.
-
Logging
On arrival at our Mayfield workshop, every serial number is logged, whether the job is processed straight away or not. That log is the basis of your certificate.
-
Secure holding
Devices awaiting destruction are held in a locked cage in ITAR's own section of the workshop, away from any public area and monitored by CCTV. Most jobs are sanitised the same day. If a late pickup has to wait overnight, it stays in its locked bin inside the cage, kept apart from other e-waste and other data destruction jobs.
-
Sanitisation
Data-bearing devices are handled by one person only: Wes Whitworth, ITAR's managing director. Hard disk drives are dismantled and their platters shattered or bent. Solid state drives are sanitised with ATA Secure Erase.
-
Certificate
On request, you receive a destruction certificate serialised to each machine and each individual drive.
-
Reuse or recycling
Only then is equipment assessed for reuse. What can't be reused is weighed out to our downstream recyclers.
Governance
What you can hand an auditor
Getting rid of old IT is the easy part. Showing it was done properly, months or years later, is where organisations get caught out. We give you the records.
Data Destruction Agreement
Issued to you before any collection takes place.
Serialised destruction certificate
Per machine and per individual drive, available on request.
Serial log
Every device is recorded on arrival. We retain destruction records, and a copy is taken off site every day.
Weight report
On request: what we collected, weighed in on calibrated floor scales, and where it went, whether refurbished for community reuse or weighed out to recyclers. Useful for your sustainability and ESG reporting.
Insured
ITAR holds public liability and professional indemnity insurance, each to $20 million.
If your organisation is covered by the Privacy Act 1988, Australian Privacy Principle 11 requires you to take reasonable steps to destroy or de-identify personal information you no longer need. A documented chain of custody and a serialised certificate are your evidence that those steps were taken.
Who it suits
For any organisation that holds data on its devices
Businesses, government, councils, NGOs and not-for-profits: any organisation that needs careful handling of data-bearing devices at the end of their service life.
Data security is core to how we operate. Our processes support our ongoing work with Commonwealth and NSW Government organisations, including NSW Health and NSW Police Force, alongside businesses and community organisations.
Already have a managed services provider? There's no conflict. Equipment at the end of its service life usually isn't something they handle, and it is exactly what we do.
Talk to us
Arrange secure data destruction
Tell us roughly what you have: how many machines, drives or devices, and where they are. We'll send you our Data Destruction Agreement, then arrange collection or a drop-off at our Mayfield site. If you have an asset list or manifest, email it with your enquiry.