Storage Anomaly Case Auditor: David Ross

Ownership Changed, Retention Did Not: Identifying Orphaned Retention Policies and Storage Bloat After Department Handover

When departmental custodianship migrated between business units, snapshot diffs exposed 38 TB of unaccounted data retained under obsolete owner permissions.

Snapshot Comparison Matrix

TreeSize review context & volume diff breakdown
Diff Target: /corp/storage/ops_migration_2026/shares
Ownership Changed, Retention Did Not

Visualizing branch lineage and allocation shifts between baseline and follow-up storage snapshots.

Storage Growth & Anomaly Diagnostics

During routine quarterly infrastructure auditing, differential snapshot analysis highlighted an abrupt stagnation in data lifecycle purging across the shared departmental mount points. Following an organizational restructuring where the core applications team assumed control over historical analytics buckets, ownership tags were updated in Active Directory, yet baseline automated lifecycle rules failed to map onto the newly assigned security identifiers. Over four consecutive snapshot intervals, unpurged staging tables and temporary archive tarballs accumulated 38.4 TB of stale volume capacity.

Differential Root Cause Identified

Snapshot differential comparison revealed unlinked POSIX permissions and legacy ACL bindings. When folder ownership transitioned, automated retention scripts lost execution privileges on sub-tree directories, preventing scheduled purge cycles from executing.

TreeSize comparative analysis and snapshot diff inspection revealed that over 140,000 intermediate export files had exceeded their 90-day retention ceiling without triggering eviction alarms. The delta analyzer caught the anomaly by cross-referencing snapshot metadata changes against modification timestamps, confirming that zero read/write operations had taken place on the affected directories for over five months despite consistent capacity billing increases.

Frequently Analyzed Anomaly Inquiries

Audit Discussions & Peer Review

Technical insights and corroborating investigations

Moderated Thread
No audit comments recorded yet. Be the first to contribute an observation below.

Submit Audit Observation