Hard Drive Destruction Equipment for Government Agencies: Degaussing, Crushing and Shredding Explained

By Security Pro USA · GSA Schedule GS-07F-0577T · Updated October 2026

Every agency retires hard drives, body-camera storage, laptops and phones. What happens to that media is the last link in the security chain, and the one auditors increasingly ask about.

Agencies spend heavily protecting data while it is in use: access controls, encryption, network monitoring. Then a server is decommissioned, the drives go into a box in a storage closet, and months later the box goes to a recycler nobody vetted. Evidence-room systems, booking databases, body-camera footage, HR files and criminal justice information all end up on media that eventually has to be destroyed. The question is whether that destruction can be proven.

This guide explains how degaussing, crushing and shredding actually work, which method fits which media, and how to build an in-house program that stands up to an audit. Our team evaluates destruction workflows with the instructors and staff at California Tactical Academy, where we run the equipment the way an agency IT or evidence team will: in batches, with paperwork, under time pressure.

The Standards That Drive the Purchase

Three documents decide what most agencies must do:

• NIST SP 800-88 Revision 2 (Guidelines for Media Sanitization). Published in September 2025, replacing Revision 1. It keeps three methods: Clear (overwrite, protects against simple recovery), Purge (makes lab recovery infeasible, for example degaussing magnetic media or cryptographic erase) and Destroy. Revision 2 is now a program standard: it asks agencies to map data sensitivity to a method, document every device and validate the result, and it points to IEEE 2883 for device-level techniques. It also warns that shredding or pulverizing alone should be avoided for anything above the lowest sensitivity categories. Most federal, state and local policies are written around it.
• FBI CJIS Security Policy. Agencies holding criminal justice information must sanitize or destroy digital media before disposal or release, and keep records of it. Check the current policy version for the exact documentation your state CJIS systems agency expects.
• NSA/CSS Evaluated Products List (EPL). For classified national-security information, destruction equipment must appear on the current EPL for that media type. Listings are model-specific and change, so verify the exact model before purchase.

If your agency handles health records (jail medical units, for example) or payment card data, HIPAA and PCI DSS add their own disposal and documentation expectations on top. For a step-by-step policy checklist, see our NIST 800-88 Revision 2 checklist for law enforcement IT.

Method 1: Degaussing (Magnetic Media Only)

A degausser applies a magnetic field strong enough to scramble the magnetic domains that store data on hard disk drives and tape. Done with a unit rated for the drive's coercivity, it is a Purge-level method, and it is fast: seconds per drive. Under Revision 2 it is a Purge technique, not a Destroy method, which is why agencies follow it with physical disabling (Method 2).

The critical limit: degaussing does nothing to solid-state drives, USB sticks, SD cards or phones. There is no magnetic layer to disrupt. As agencies replace spinning drives with SSDs, a degausser-only program quietly stops covering a growing share of the media.

Agency options range from desktop units to high-volume systems:

• Garner HD-2XT and HD-3XTL: compact hard drive and tape degaussers for departments with modest volume.
• Garner TS-1XT and TS-4XT: higher-throughput units for data centers and county IT.
• Proton T-4 and Proton T-5: listed by the manufacturer as NSA/CSS EPL degaussers; confirm current listing before citing it.

Method 2: Crushing and Punching (Physical Disabling of HDDs)

A hard drive destroyer deforms or punches through the platters so the drive cannot spin up, be reused or be read with normal equipment. The standard agency workflow is degauss first (Purge), then crush. The purge removes the data; the crush makes the drive permanently unusable and gives visible evidence anyone can see, which matters when a supervisor, auditor or chain-of-custody witness signs off. For moderate- and high-sensitivity data, Revision 2 does not treat crushing on its own as sufficient, so purge before you crush.

• Garner PD-5: hydraulic hard drive destroyer for routine volumes.
• Proton PDS-100 and PDS-75: crushers listed by the manufacturer on the NSA/CSS EPL.
• Proton PDS-30: manual, no-power destroyer for small offices and field use.

Method 3: SSD Sanitization, Destroyers and Shredding

Solid-state media stores data on flash chips spread across the board, and a degausser cannot touch it. The Revision 2 approach is to purge the SSD first with its built-in sanitize or cryptographic erase function (where it meets NIST's preconditions), verify it, and then physically disable it with an SSD destroyer that punches the chips or a shredder. For the lowest sensitivity categories, physical destruction alone may be acceptable under your policy; for anything higher, do not rely on shredding alone, and follow your controlling policy (for classified data, NSA guidance).

• Garner PD-5SSD: one machine for both HDDs and SSDs, the practical choice for most mixed-media agencies.
• Garner SSD-1: SSD destroyer attachment for an existing PD-5.
• Proton PDS-88: shredder for SSDs, flash media and phones.
• Proton 105: industrial multimedia shredder for data centers and regional consolidation sites.

Which Method for Which Media

Media	Purge with	Then physically disable with	Notes
Hard disk drives (HDD)	Degausser rated for the drive	HDD crusher or punch	Classified: EPL-listed degausser
Magnetic tape	Degausser rated for the tape	Shredder (machine-dependent)	Check coercivity rating
Solid-state drives (SSD)	Built-in sanitize or cryptographic erase	SSD-rated destroyer or shredder	Degaussing has no effect
USB, SD cards, phones	Device sanitize or factory reset where supported	SSD-rated destroyer or shredder	Degaussing has no effect

The practical takeaway for most agencies: a degausser plus a combined HDD and SSD destroyer, used after purge, covers nearly everything they hold. Classified programs add EPL-listed equipment and the techniques their controlling policy requires.

Proof: The Part Most Programs Skip

Destroying the drive is half the job. The other half is being able to show, months later, which serial numbers were destroyed, when, by whom and how. Revision 2 makes this explicit: verify that each sanitization completed, then have the agency validate the result in writing. Without that record, an agency cannot answer an auditor, a records request or a defense attorney asking what happened to a piece of evidence-related media.

Garner's IRONCLAD verification system handles this. It photographs and logs each drive, captures the serial number and the operator, and produces a destruction certificate. The SCAN-1X reporting scanner adds barcode capture for batch work. Complete packages such as the DD-25SSD IRONCLAD and DDR-1XT5SSD IRONCLAD workstation combine a degausser, an HDD/SSD destroyer and IRONCLAD in one purchase, which is usually simpler to justify and to procure as a single line item. Mobile carts such as the RCC-25SSD take the whole kit between buildings or substations.

In-House vs. Outsourced Destruction

Outsourcing looks cheaper until you count what leaves the building. When a vendor hauls media away, the agency gives up direct custody, relies on the vendor's certificate, and carries the risk if a drive goes missing in transit. In-house destruction keeps custody unbroken: the media never leaves agency control, and the record is created by agency staff at the moment of destruction.

For agencies holding criminal justice information, evidence-related media or classified material, in-house destruction with verification is usually the cleaner answer. A useful test: if you would not hand the drives to a stranger at the curb, think hard before handing them to a truck.

Building an Agency Destruction Program

1. Inventory the media. Count HDDs, SSDs, tape and mobile devices retired per year, and where they sit today.
2. Map each media type to a method using the table above and your policy (NIST Revision 2, CJIS, EPL).
3. Choose the recordkeeping first. Decide what a destruction record must contain, then buy equipment that produces it.
4. Assign custody. Name who collects, who destroys, who witnesses and who validates, and lock the staging area.
5. Clear the backlog, then run on a schedule. Most agencies have a closet of old drives; destroy it once, then move to monthly or quarterly batches.

Buying Through Security Pro USA

Security Pro USA is an authorized Garner Products dealer and carries Proton Data Security equipment. We hold GSA Schedule GS-07F-0577T; not every model is on contract, so confirm GSA availability before citing it on a requisition (see our agency purchasing page). Verified agencies can buy on purchase order with Net-30 terms. Send us your media mix and any EPL or CJIS requirement and we will confirm the exact configuration before you order.

Size your agency's destruction program with our agency desk.
Call 1-800-264-8273 or request an agency quote. Browse Data Destruction & Media Sanitization, Garner, Proton Data Security and NSA-listed equipment.

Frequently Asked Questions

Does a degausser erase an SSD?

No. Degaussing only affects magnetic media. SSDs, USB drives, memory cards and phones need their built-in sanitize or cryptographic erase function, followed by physical destruction with an SSD-rated destroyer or shredder.

Is crushing a hard drive enough?

For the lowest sensitivity categories it can be, depending on your policy. For moderate- and high-sensitivity data, NIST SP 800-88 Revision 2 says not to rely on physical destruction alone: degauss the drive first, then crush it. Classified programs must follow the EPL and NSA requirements for the media type.

What equipment does a police department need for hard drive destruction?

For most departments: one degausser for HDDs and tape, one combined HDD and SSD destroyer, and a verification system that logs serial numbers and produces certificates. A packaged system such as a Garner IRONCLAD bundle covers all three.

How do we prove media was destroyed for CJIS or an audit?

Keep a record for each device with serial number, date, method, operator and witness, plus a written validation sign-off. Verification systems such as Garner IRONCLAD capture the device record automatically, including a photo of each destroyed drive.

Can we buy degaussers and destroyers on GSA or a purchase order?

Yes. Security Pro USA holds GSA Schedule GS-07F-0577T and quotes against agency purchase orders. Confirm which models are on contract with our agency desk before citing it.

This guide is general information, not a compliance determination. Confirm the media sanitization requirements that apply to your agency, including the current versions of NIST SP 800-88, IEEE 2883, the CJIS Security Policy and the NSA/CSS Evaluated Products List, before purchase.