Finding shadow data: old exports, shared drives and personal mailboxes

What counts as shadow data in a mid-size company?#

Shadow data is a copy of company records that its system of record no longer controls: a ticket export saved to a file share during a help desk migration, a customer list attached to an email, a database backup on a server nobody logs into. Nobody planned to keep it, so nobody applies access rules, retention or review to it.

Data security vendors popularized the term, but any IT lead at a company that has run several generations of software knows the problem. Every migration, audit, board report and departing salesperson leaves copies behind, and most of them hold the same customer and employee details as the live systems.

Before a licensing project, shadow data matters for two reasons. Unreviewed copies of in-scope records undercut the claim that personal data was handled, and a forgotten export may hold the only remaining history from a system the company retired long ago.

Where shadow data usually hides#

Shadow data collects wherever someone needed records outside a system and had nowhere official to put them. The table covers the usual locations in companies running a mix of SaaS tools, Microsoft 365 or Google Workspace, and a few on-premises servers.

Is shadow data a risk or an asset?#

Shadow data is mostly a risk and occasionally an asset, and the treatment depends on what the copy is. A duplicate of records still in the live system adds exposure and no value. An export from a help desk you shut down may be the only place years of support history still exist.

Decide each found copy against a short rule set instead of debating it from scratch. The rules stop IT from deleting something the business needs, and they stop a promising archive from entering a licensing scope without anyone knowing where it came from.

A discovery plan in two passes#

A shadow data discovery plan works best in two passes: first ask people and read storage metadata, then scan and decide one location at a time. Asking first is faster than scanning everything, because long-tenured staff usually remember where the old exports went.

Keep discovery metadata-only wherever you can. File names, sizes, dates and owners settle most locations; opening files is needed only for licensing candidates and unknowns.

• 1First pass: ask department heads, long-tenured staff and former system owners where old exports, reports and archives were saved.
• 2First pass: pull finance's list of cancelled software vendors to name every retired system that might have left an export behind.
• 3First pass: run storage reports for large files and archive types such as PST, ZIP, BAK, SQL and CSV across file shares and cloud storage.
• 4First pass: list sites, buckets and accounts with no owner or no recent activity.
• 5Second pass: scan each found location with your DLP or classification tool and record the match types and counts.
• 6Second pass: assign an owner, apply the rule set, and add a row to the data inventory for each location.
• 7Second pass: write a provenance note for every licensing candidate before anyone opens or copies the files.

Personal mailboxes need a lighter touch#

Personal mailboxes need a lighter touch than file shares because they mix business records with private correspondence and are often covered by employee notices, retention rules and legal holds. Search them by metadata, not by reading: attachment type, attachment size, sender and recipient domains, and subject lines that suggest exports.

Mailboxes themselves rarely belong in a licensing scope. The aim is to find exports that traveled through them, such as a full customer list sent to a personal address or a ticket dump sent to a contractor, and to trace each one back to its source system. Bring in the privacy lead or counsel before any targeted mailbox search, and record who approved it.

In Microsoft 365, Purview eDiscovery is the usual route for a controlled, logged mailbox search, and it can export results as PST files or individual .msg files. Microsoft states that search exports expire 14 days after creation, so plan the download before starting a large export. Remember too that files shared in Teams chats are stored in the sharer's OneDrive, which makes departed employees' OneDrive accounts a common home for exported reports.

Illustrative: a 3PL finds its old warehouse history#

Illustrative: a fictional third-party logistics company replaced its warehouse management system and moved transportation planning to a new TMS. While preparing to license order exception and service records, its IT lead runs the two-pass discovery before anything is scoped.

Interviews point to a NAS in the main warehouse office. Storage reports find a folder named after a former operations manager that holds full exports of the old WMS exception log and carrier claims, plus a database backup from the retired TMS. A mailbox search by attachment type finds a customer contact list that a sales rep emailed to a personal account before leaving.

The team writes a provenance note for the WMS exports, checks the old vendor contract to confirm the company may use its own exported records, and adds them to the candidate scope pending preparation. The TMS backup duplicates migrated data and goes to retention review. The emailed contact list goes to the privacy lead under the company's incident process.

How SourceX handles found archives#

SourceX handles found archives in the first two steps of the SourceX five-step transaction, Supply and Rights, before Preparation, Approval and Delivery. An old export can be part of a package, but only with a provenance record stating which system produced it, when, by whom and whether it is complete.

That provenance goes into the SourceX Evidence Packet with licensing rights, permitted use, the privacy record and release authorization. Large archives stay in the supplier's own storage or ship on encrypted drives, SourceX never hosts multi-terabyte datasets, and the supplier approves every step.