We have several file servers containing about 18 TB of data, but our assessment identifies only around 3 TB as archive candidates. The current file-level rules are: classify data as Active/Migrate when it was modified within the last three years OR accessed within the last 180 days; classify it as an Archive Candidate when it was modified more than three years ago AND accessed more than 180 days ago. At the folder level, we label a folder Migrate when 30% or less of its data is older than the cutoff, Archive when at least 80% is older and no file was modified in the last 30 days, and Review for everything in between, recently touched old data, or folders with scan errors. Is the access-time condition causing the low archive total, and what would be a more reliable way to define the archive criteria?
3 Answers
Changing the thresholds will naturally change the reported archive volume. Your file-level rule uses a 180-day access window, while the folder-level rule uses a 30-day modification window, so they are measuring different things. Make the definitions consistent, document whether the percentages are based on bytes or file counts, and separately report folders with access-timestamp errors or unreliable timestamps instead of treating them as active.
I would remove the 180-day accessed test from the primary archive decision and base it mainly on modification time. Use the recent-modification check as a safety guard: for example, classify a folder as Archive only when at least 80% of its data is older than three years and no file was modified during the last 30 days. Put borderline folders into Review. This avoids allowing automated scans, backups, or antivirus activity to prevent otherwise dormant data from being archived.
The accessed-date condition is probably the biggest problem. On Windows, NTFS last-access updates may be disabled, system-managed, or affected by scanning and backup software. If updates are enabled, antivirus and backup jobs can touch most of the files and make the entire volume appear recently accessed. If they are disabled, the timestamps may simply be stale. Check the last-access configuration on every server before relying on it, but treat the results cautiously either way.
I changed a setting recently, but I may have changed the wrong one. When you mention the folder rollup logic, do you mean how the file-level ages are combined to classify an entire folder?
That makes sense. I was mixing the access cutoff with the folder-level modification cutoff. I will test a modification-time-only report first and keep uncertain folders in Review.