How to Sell Used Hard Drives for Cash HDD and SSD Buyback Guide

How to Sell Used Hard Drives for Cash: An HDD and SSD Buyback Checklist

In September 2022, the Securities and Exchange Commission fined Morgan Stanley Smith Barney $35 million over the way it disposed of decommissioned hardware. The firm had handed thousands of hard drives and servers to a moving and storage company that had no data destruction expertise, and that vendor then sold the devices on to third parties, where they turned up on internet auction sites with unencrypted customer information still readable on them. Most of the equipment was never recovered.

That is the expensive version of a job that a lot of IT teams treat as an afternoon errand. Somebody pulls a few hundred drives out of a decommissioned rack, the drives sit on a pallet in a storeroom for eight or nine months, and eventually a person asks whether they are worth anything. In most cases, they are worth quite a lot, because enterprise drives hold their value better than almost anything else that comes out of a rack. A good share of that value gets thrown away simply because the process around it was never written down anywhere.

What follows is that process, in the order it has to happen. It is written for organizations disposing of drives in quantity, following a data center refresh, a lease return, a cloud migration, or a facility shutdown, rather than for an individual selling one laptop drive on a marketplace.

What a Buyer Actually Means by a Used Hard Drive

Buyback vendors sort inbound drives into categories that do not always match the way the seller thinks about them, so it is worth knowing the categories before you build the inventory list.

An HDD is a mechanical drive that stores data on spinning magnetic platters. It is the format that degaussers were designed for, and it still accounts for most high-capacity enterprise storage.

An SSD is a solid-state drive that stores data in NAND flash and has no moving parts. Flash behaves very differently under sanitization, which matters later in this checklist.

NVMe is a protocol rather than a form factor. It runs flash storage directly over PCIe instead of going through a SATA or SAS controller, and NVMe drives coming out of recent data center hardware are currently among the most sought-after categories in the resale market.

Enterprise SAS and SATA describe the interface the drive was built around. SAS drives generally come out of servers and disk arrays and are built for a heavier duty cycle, while SATA covers both server and desktop use.

Internal and external is a real dividing line for buyers. External USB drives are consumer stock and are priced accordingly, whereas internal 2.5-inch and 3.5 inch drives pulled from servers, disk shelves, and arrays are what the commercial buyers are actually looking for, particularly in the 4TB to 16TB range.

The Nine-Step Checklist for Selling Used Hard Drives

1. Build the Inventory at Serial-Number Level

The list needs to be built by serial number rather than by pallet or by rack. You need the manufacturer, model, capacity, interface, and serial number of every drive before anything physically moves, because this list is what you get quoted against, and it is also the only document that will tell you later whether every drive that left the building arrived somewhere. Missing drives are normally discovered by comparing two lists against each other, so if you only ever had one list, you are unlikely to discover them at all.

2. Separate Magnetic Media From Flash Before Choosing a Method

If you do this early, the rest of the sanitization decision gets much simpler, because the method depends entirely on the media type. Degaussing destroys data on magnetic media, which means HDDs as well as LTO and DLT tape. It does nothing useful to an SSD. Flash storage uses wear leveling and over-provisioning, so blocks holding older data can sit outside the addressable space, where an overwrite pass or a physical hole drilled through the case will never reach them. SSDs require the manufacturer's own secure-erase command or a cryptographic erase instead.

3. Choose a Sanitization Level: Clear, Purge, or Destroy

The relevant standard here is NIST Special Publication 800-88 Revision 1, and it defines three levels. Clear, purge, and destroy escalate from logical techniques that defeat ordinary recovery software, to methods that defeat laboratory recovery techniques, to physical destruction that leaves the media unusable for storage. The same document also covers cryptographic erase for self-encrypting drives, which is one reason a fleet that was encrypted at rest from the beginning is considerably cheaper to retire than a fleet that was not.

Most enterprise buyback work runs at the purge level, because purge preserves the drive itself. Destroy is the appropriate answer for failed drives, for drives that cannot be verified, and for anything covered by an internal policy that does not permit resale.

4. Decide Whether Each Drive Is Worth More Wiped or Shredded

These are not competing philosophies; they are two different answers to a question about condition. A healthy 12TB SAS drive with reasonable power-on hours is worth considerably more sanitized and resold than it is as shredded aluminum and rare earth material, while a drive that has failed its SMART checks is worth approximately nothing on the secondary market and should go directly to destruction. Sorting this out drive by drive is probably the single biggest lever on what you get paid, and it is also the step that gets skipped most often, usually because shredding an entire pallet is easier to explain to an auditor than a per-drive decision is.

5. Grade the Condition Honestly

Buyers test what you send them, so an optimistic grade only delays the conversation by a week. Pull the SMART data, including power-on hours, reallocated sector counts, and for SSDs, the percentage of rated write endurance that has been consumed. Age matters less than most people assume. Backblaze, which publishes quarterly failure statistics for its production fleet, reported an annualized failure rate of 1.24% across 341,263 drives in the first quarter of 2026. Drives coming out of a well-run facility routinely have several years of usable service left in them, which is precisely why a secondary market for them exists.

6. Get the Certificate of Destruction Written Into the Contract, at Serial Level

A certificate stating that one pallet of drives was destroyed is close to worthless in an audit. What survives scrutiny is a serial-level record, meaning every drive listed individually with the method applied and the date it was applied, supported by a chain-of-custody trail that starts at the pickup and ends at either the shredder or the verified wipe log.

This is the point where the specialist ITAD buyers separate from the general electronics recyclers, because running resale and destruction through a single intake process is the only practical way to make both of them defensible. Organizations that want to sell used hard drives rather than simply destroy them need both motions from one vendor.

Big Data Supply, an R2v3 and RIOS certified ITAD operator based in Santa Ana, California, runs hard drive buyback and certified destruction through that same intake, so drives with market value are sanitized to NIST 800-88 and resold; the remainder are shredded, and either path ends in a serial-level certificate of destruction backed by an audited chain of custody that the company describes as running from pickup to particle. Its published terms include a destruction quote within one business hour and payment approximately five to seven business days after verification, covering SATA, SAS and SSD drives in the 4TB to 16TB range across Western Digital, Seagate, Hitachi, Toshiba and Samsung.

That reuse-first position is not universal in the industry. A good number of vendors shred by default, partly because a shredder is simpler to document than a verified erasure process is, and the seller absorbs the lost resale value without ever seeing the number.

7. Check That the Certification Covers the Site Doing the Work

R2v3 and RIOS certifications are issued to facilities rather than to companies in the abstract. A vendor can hold a certification for one processing site and then subcontract your drives to a second site that holds nothing at all. Ask which facility physically handles the media, ask for the certificate number, and verify that number with the issuing body rather than accepting a logo on a PDF. This is more or less the exact gap that the Morgan Stanley case ran through.

8. Agree the Chain of Custody, Including the Transport Leg

Transport is the stage at which drives tend to go missing. Decide before the pickup whether you are using sealed and numbered containers, whether the vehicle is GPS tracked, who signs at each handoff, and what the reconciliation process looks like when the shipment is received and checked against your serial list. If the drives are sensitive enough, on-site destruction before they leave the building removes the transport risk altogether, at the cost of the resale value you would otherwise have recovered.

9. Move Before the Value Decays

Storage hardware depreciates on a schedule that is indifferent to whether you have found time to deal with it. Industry estimates commonly put the loss at approximately 20% to 30% of recoverable value over six to twelve months sitting in a storeroom, and the drop tends to steepen once a drive generation falls two steps behind current production. If a refresh is already planned, it is better to start the disposition conversation while the replacement equipment is still on order, rather than after the old drives have been on a pallet for a year.

What Your Drives Are Actually Worth

Very few buyers can give you a real number from a description alone, and any vendor publishing a fixed price list for enterprise drives is either guessing or excluding most of what you have. The offer is driven first by capacity, then by interface and generation, then by condition, and then by quantity. One hundred matched 8TB SAS drives out of a single array are worth more per unit than one hundred mismatched drives from six different platforms, because the buyer can resell the matched set as a lot.

Two things reliably reduce a quote. The first is drives arriving with no inventory list at all, and the second is mixed pallets that have to be sorted by hand at the receiving end. Both of those are labor costs, and the buyer prices them into the offer.

The floor underneath all of this is materials recovery, and it is a low floor. The Global E-waste Monitor 2024, published by ITU and UNITAR, recorded 62 million tonnes of e-waste generated in 2022, with only 22.3% documented as formally collected and recycled. Scrap value on a hard drive amounts to a few dollars of aluminum and steel. The difference between that figure and a resale price is almost entirely a function of the process described above.

Frequently Asked Questions

Can You Actually Get Cash For Used Hard Drives, Or Only Recycling Credit?

You can get cash, provided the drives have resale value. Commercial buyback vendors pay for enterprise-grade drives outright, normally after receiving, testing, and verifying the inventory. Drives that fail testing usually go to recycling instead, and the recycling cost is generally netted off against the payment for the rest of the lot.

Do I Need To Wipe The Drives Myself Before Sending Them?

Not if the buyer is certified for data destruction and issues a certificate, and in most situations you should not attempt it. Deleting files or formatting a drive only removes the pointers to the data, and ordinary recovery software will retrieve it. A verified NIST 800-88 process with a serial-level certificate is what an auditor will ask to see, and performing an unverified wipe in-house first gives you no documentation at all while risking damage to the resale value of the drive.

Does Degaussing Work On SSDs?

It does not. Degaussing works only on magnetic media, and an SSD stores data in flash cells that a magnetic field does not affect, so a degaussed SSD is simply an intact SSD with all of its data still on it. The correct methods are the manufacturer's secure-erase command, or a cryptographic erase if the drive is self-encrypting.

Is A Certificate Of Destruction The Same As A Certificate Of Recycling?

They are two different documents. A certificate of recycling confirms that material entered a recycling stream, and it speaks to environmental compliance. A certificate of destruction states that specific data-bearing media was sanitized or destroyed by a stated method on a stated date, and it should list serial numbers. Only the second document is evidence in a data protection audit.

How Long Does The Whole Process Usually Take?

Assume a few days for the quote once a complete inventory list exists, then a week or two for logistics depending on the volume and on whether a pickup is involved, and then testing and verification at the receiving end before payment is released. Vendors commonly quote payment within five to seven business days of verification. The step that tends to stretch is almost always the inventory, because that one happens on your side.

The Part Most Teams Get Wrong

The recurring failure here is not choosing a bad vendor. It is treating destruction and value recovery as two separate projects, run by different people at different times. The security team generally wants everything shredded, because that is the simplest position to defend. Finance wants the residual value that is still sitting on the asset register. When those two conversations happen in the same room, before the drives are pulled, both outcomes are available. When they happen six months apart, the drives sit in a storeroom losing value until somebody makes the safe decision by default.

Key Takeaways

• Build a serial-level inventory before anything leaves the building. It is the basis of the quote, and it is the only way to reconcile what actually arrived.
• Sort magnetic drives from flash first. Degaussing handles HDDs and tape, and it does nothing at all to an SSD.
  NIST 800-88 defines three levels: clear, purge, and destroy. Purge preserves resale value, while destroy is for failed or unverifiable drives.
• Insist on a serial-level certificate of destruction and an unbroken chain of custody that also covers the transport leg.
• Verify that the certification you were shown belongs to the facility that is physically processing your media.
• Start the disposition process while the replacement hardware is still on order, because value decays fastest in the storeroom.