File servers and mail archives: where forgotten personal data piles up

An organization’s largest store of personal data is rarely in its newest systems. It sits in the oldest shared folders and in mail archives nobody has opened in years. These places never make it into inventory questionnaires, fall outside DLP policies and have no entry in the retention schedule, yet they are the first thing an auditor, a breach investigation or a data subject request points at. File servers and mail archives are not low-risk because they are invisible; they are unmeasured risk because they are invisible.

Why the oldest data is the least visible

A file server keeps the same address for a decade, and every reorganization adds another layer to its folder tree. Folders named “Old_HR”, “Payroll_2016_backup” or “Accounting_archive_final” are the typical traces of data that once served a purpose and then lost its owner. The people who created them have often left, departments have merged, and the processes moved to new applications. What remains is a pile nobody owns but for which the organization is still the data controller.

Mail archives follow the same pattern. When mailbox quotas fill up, employees export messages to PST files, which then wait for years on local disks, personal network folders and shares labelled “archive”. Inside them are customer contracts, forms carrying national ID numbers, payroll attachments, medical reports and contentious correspondence. The file is seen as a single object; it contains tens of thousands of messages and attachments.

KVKK, Türkiye’s data protection authority, explains on its page on deletion, destruction and anonymization of personal data that data whose processing purpose has ended must be deleted, destroyed or anonymized. The practical difficulty is simple: if you do not know where the data you must delete lives, the retention policy remains a document rather than a practice.

Where it accumulates on file shares

Personal data on file servers follows recognizable patterns. Knowing them is what makes the discovery scope right:

• Payroll and HR folders. Pay slips, social security registrations, ID card copies, hiring forms, performance and disciplinary correspondence. National ID numbers, IBANs, phone numbers, addresses and health data sit side by side.
• Occupational health and safety folders. Periodic examination results, scanned reports, ICD-coded diagnoses. Special-category data frequently sits in a general “OHS” share with a wide group of readers.
• Accounting and finance archives. IBANs and tax ID numbers on invoices and receipts; contact details in customer ledgers; card numbers in payment instructions.
• Sales and customer service. Identity and contact details of customer representatives in quotes, contracts and complaint files; call-centre transcripts.
• Personal network folders (home directories). Everything an employee copied as a “desktop backup”: old projects, scan output, personal PST files.
• Local disks. Temporary exports, report output and database dumps left on Windows, Linux and macOS workstations and servers.

What these patterns share is data that was produced for a business process and never moved anywhere when the process ended. The older the data, the more likely its retention period has expired, and the less likely anyone can be found who owns it.

Permissions: unreadable, unresolved, inherited

Risk on a file server is not only about content; it is about who can reach the content. ACLs that accumulate over years carry three typical problems.

First, inherited broad permissions. A parent folder was once granted to “Domain Users” or “Everyone”, and every subfolder inherited it. The whole organization may be able to read “Payroll_2016_backup” today; nobody decided that on purpose.

Second, unresolved SIDs. When departed employees’ accounts are removed from the directory, only an identifier remains in the ACL. These entries look harmless, but a recreated account or a mapping error during a directory migration can turn them into unexpected access. And an auditor’s question “whose permission is this?” has no answer.

Third, unreadable permissions. On some shares the scanning account can read content but not the security descriptor; on NFS exports the identity mapping on the client side may be incomplete. The wrong response is to skip the file. The right response is to classify the content and report explicitly that the permission data could not be collected, because “permission unreadable” is itself a finding.

The Seratus access and exposure graph shows these three cases separately: overshared folders, unresolved SIDs and paths with missing permission data are ranked together with the density of personal data found in the content.

Mail archives: live monitoring versus archive discovery

When e-mail comes up, two different activities tend to be confused. One is monitoring employees’ live mailboxes and mail traffic. The other is discovering what sits inside PST, OST and MSG files on disk. They are different both technically and legally.

KVKK’s Board Principle Decision 2026/2035 of 16 September 2026 states that monitoring corporate e-mail and other communication channels is a data processing activity requiring a fair balance between the employer’s management right and the employee’s private life; that the employer owning the tool does not grant unlimited monitoring authority; that “technically able to access” must be separated from “legally able to access”; and that content review should be limited to a concrete suspicion or incident, avoiding reviews that are vague in scope, general and continuous. Access by limited staff, access logging and limited retention are part of the same framework.

This framework clarifies two things when designing archive discovery. First, the purpose is not to read employees’ correspondence but to inventory the organization’s personal data holdings and destroy what has expired; the scope, method and retention period must be explained clearly to employees. Second, console access must be role-based and logged; findings are shown as masked samples, and full content is opened only inside an approved review workflow with a record. Seratus is designed to operate within that frame: it does not connect to live mailboxes, does not monitor traffic and only opens archive files on disk in read-only mode. This article is not legal advice; the content of a monitoring policy should be settled with counsel.

Dimension	Live mail monitoring	Archive file discovery (Seratus)
Source	Mail server, live mailbox	PST/OST/MSG files on disk
Timing	Continuous stream	At scan time, repeatable
Purpose	Conduct monitoring	Asset inventory, retention, destruction
Presentation	Message content	Masked sample, confidence, location
Access	Often broad	Role-based, audit-logged

What a discovery result should look like

The output of a file server or mail archive scan has to say more than “personal data was found in this many files”. A useful result has at least these layers:

• Location and context. Share, folder path, file type; for PST files, the position at message and attachment level. “Which folder, which message’s attachment” must be answerable.
• Type and confidence. Detection types such as national ID number, IBAN, phone number or health data, each with a confidence percentage and a masked sample. False positives (sequential numbers, test data) should already be filtered out. The Turkish detection engine carries those validation rules.
• Confidentiality level and business category. Whether the file is “payroll”, “medical report” or “contract”, and where it sits on the scale from public to top secret; these labels feed retention and destruction processes.
• Access. Who can read it, through which group, whether permissions were readable, whether unresolved SIDs are present.
• Age and ownership. Last modification date, creating account, whether that account is still active.

Together these layers produce a concrete finding such as “a payroll folder from 2016, readable by the entire organization, containing a large number of national ID numbers, whose owner left three years ago”. A finding like that can be prioritized, assigned and closed.

Quarantine: stopping before deleting

The most common hesitation about data in old folders is “will something break if we delete it?” The hesitation is justified; some old folders are still subject to a statutory retention period or are used by a process nobody expected. Quarantine is how that uncertainty is managed.

In quarantine the file stays in place, but access is closed and the file enters a review queue. The assigned owner decides within a set time: if retention continues, the file is reclassified and access is narrowed; if the period has expired, it goes into the destruction or anonymization flow; if it was a false positive, it is released. Each step is written to the audit log with who, when and why. Destruction is approved by a separate authority; if a redacted copy is needed, it is produced before the original is destroyed.

This workflow turns the obligation described on KVKK’s deletion and destruction page into something that can be executed: find first, then stop, then decide, then destroy and prove it.

How Seratus closes these gaps

Gap 1: File servers and local disks are outside the inventory. Seratus scans SMB/CIFS shares, NFS exports and Windows, Linux and macOS local disks without agents and in read-only mode; interrupted scans resume where they stopped. Results flow directly into the VERBİS inventory and into the “data not in inventory” gap on the KVKK readiness score. Details: file server integration.

Gap 2: Nobody can see inside PST/OST/MSG archives. Seratus opens archive files where they sit on disk, extracts personal data from message bodies and attachments and never connects to a live mailbox. Findings are shown with masked samples and confidence percentages. Details: email archives (PST).

Gap 3: Old payroll and HR folders are open to everyone. The access and exposure graph shows inherited broad permissions, “Everyone” and “Domain Users” entries, access held by departed users and unresolved SIDs together with the data density of the content; permission removal runs through the approval workflow.

Gap 4: Paths with unreadable permissions are silently skipped. Seratus classifies those files anyway and reports the missing permission data as an explicit warning; the gap is not hidden.

Gap 5: Expired data cannot be deleted because nobody knows the consequences. Quarantine, owner assignment, second-approver sign-off and the audit log in the remediation and evidence workflow operate together with the retention schedule and the destruction and anonymization process.

Gap 6: Detections produce false positives on Turkish data types. Validation rules and a false-positive reduction program for national ID numbers, tax ID numbers, Turkish IBANs, Turkish phone numbers and licence plates; a “not found in the sample” result is never presented as a risk decision.

Takeaway

File servers and mail archives hold the organization’s oldest and least-owned personal data. Retention policies, privacy notices and destruction schedules written without inventorying these places are incomplete. Agentless, read-only discovery; visibility of permissions and unresolved identities; and a recorded workflow that starts with quarantine and ends with approved destruction turn that pile into a manageable list. Seratus runs the whole workflow inside the organization’s own network, with no data leaving it.