A Barcode Is a Keyboard: Why Scanning Drives Into a Spreadsheet Isn't Evidence

If you’ve run a drive destruction job, you’ll know the routine. A barcode gun, a laptop, a spreadsheet, and a few hundred drives waiting to be logged before anything can go near the shredder.

This article covers three things: what that routine involves, why the record it produces is weak evidence, and what a record made at the shredder should do.

The routine, one drive at a time

For every drive, someone has to:

1. pick it up;
2. turn it to the label;
3. read the label;
4. find the serial number;
5. find the barcode that goes with the serial number;
6. cover up any other barcodes;
7. scan the right barcode;
8. check the scan against the serial they read;
9. optionally, check it against the client’s asset list;

then put the drive on the shred pile, and start again. In my experience, that’s around 10 seconds a drive. It is manual and monotonous, and that is what makes it prone to human error.

NIST suggests the same method as a help: some media “include bar codes on the label for the model and serial numbers, so the person performing the sanitization might simply enter the details into a tracking application and scan each bar code as the ISM is sanitized. Automatic documentation can be important as some systems make physical access to the ISM very difficult” (NIST, 2025, § 4.6).

Where it goes wrong

• The wrong barcode. Many labels carry several barcodes, for the serial, the model, the part number and more. It’s easy to scan the wrong one.
• No barcode at all. Not every device has a barcoded serial number.
• An editable record. The scans land in a spreadsheet that can be edited. In the usual setup, nothing ties an entry to a physical drive or shows who changed it.
• Mistakes found late. Errors often only surface at the end of the job, when the list is checked against the client’s asset list. That can send the whole job back to the start, and often nothing can go to the shredder until every asset is accounted for.

Why it’s weak evidence

Most scanners are set up to act as a keyboard. They type characters into the computer, and the spreadsheet can’t tell a scan from an entry someone typed by hand.

So when a client or an auditor opens the spreadsheet afterwards, they can tell only one thing: that somebody, an individual, said the drive was there. The certificate of destruction built from that spreadsheet is the same statement, signed. It’s an attestation, and an attestation is someone’s word.

Auditors have long treated a later statement as weaker than a record made at the time. The international audit standard, ISA 500, gives the example that a record written at the time is more reliable than an account given afterwards (IAASB, ISA 500). And under the PCAOB’s standard, the more reliable a piece of evidence, the less corroboration it needs, while “obtaining more of the same type of audit evidence… cannot compensate for the poor quality of that evidence” (PCAOB, AS 1105 .05). A thousand rows typed by a scanner are still a thousand statements.

Capture at the shredder: what exists, and what it should do

Some shredder makers now offer capture add-ons for their own machines. They pair a barcode scanner with photos, timestamps, video and certificates. That moves the record to the shredder, which is a real step forward. But most still start from a barcode, so the wrong-barcode and no-barcode problems come with it, and someone still has to scan every drive by hand. It is still slow, and still not automated.

A record made at the feed should do four things:

1. Read the serial from the label itself and confirm it, not take whichever barcode got scanned, so a drive with no barcode, or several, is still identified correctly.
2. Match each drive against the client’s asset list at the feed, so a missing or unexpected drive is flagged there and then, not at the end of the job.
3. Bind the image, the serial and the time in one capture, on a unit attached to the shredder, so the record and the destruction are the same event.
4. Hold the drive until the record is saved. The tray only empties into the cutting head once the record is committed.

That’s what we’re building at Nabel Solutions. The person feeding the machine places the drive in the feed tray, checks the capture comes back green, and authorizes the tray to empty into the cutting head. Against a supplied asset list, matching is exact. Without one, our serial identification model picks the right serial number on 97.7% of the drive labels it can read, and the exact serial on 87.4%. Measured in our lab, not on the shredder unit, on 241 labels from real storage devices, with five-fold cross-validation. 97.7% counts a serial within one character of the true one.

When the certificate arrives, the client knows more than someone’s word. Each device on it has an image, and optionally video, taken at the feed by a unit attached to the shredder, at the moment it entered the destruction device, and matched against their own asset list.

Side by side

Verified destruction

Verified destruction replaces someone’s word with a record of each drive at the moment it is destroyed. The certificate can then be checked against what was actually destroyed, which deters insiders, exposes gaps and supports any investigation.

If your certificate of destruction were challenged tomorrow, what could you show beyond somebody’s word?

References

• IAASB. ISA 500, Audit Evidence.
• NIST (2025). SP 800-88 Rev. 2, Guidelines for Media Sanitization. September 2025. § 4.6.
• PCAOB. AS 1105, Audit Evidence. .05.