Old backups and tape archives from acquisitions: retain, restore or destroy?

The rule: hold check, retention check, then value#

The rule for an acquired company's old backups is to clear two checks before any decision: a legal hold check and a retention check. Only once both are cleared does it make sense to weigh restore cost against likely value.

The order matters because destruction is the one choice that cannot be reversed. A tape shelf that looks like clutter during an office consolidation may hold the only copy of records subject to a hold, a tax examination or a customer contract obligation.

Integration teams often inherit backups with no catalog, no contents list and nobody who remembers the systems. That uncertainty is a reason to slow down, not a reason to clear the shelf.

What sits in an acquired company's backups#

An acquired company's backups usually hold more than file shares. They are often the last copy of systems retired before or during the acquisition.

Each of these needs an owner on the integration plan. Backups with no owner tend to be kept indefinitely by default or thrown out with old hardware, and both outcomes are hard to explain later.

• 1Tape sets, such as LTO cartridges, written by older backup software.
• 2Virtual machine images of retired application servers.
• 3Database backups from on-premises ERP, help desk, billing or job management systems.
• 4Exchange databases or PST exports from email systems that predate a cloud migration.
• 5NAS snapshots and file share copies holding project folders, quality records and contracts.
• 6Configuration files and stored credentials, which are a security risk in their own right.

Decision table: retain, restore or destroy#

The decision table turns the rule into a default for each common situation. Sort the backup inventory with it, then confirm each row with counsel and the finance team before acting.

How to run the hold and retention checks#

The hold check asks whether any record on the backup is subject to a litigation hold, a regulator request or a contractual preservation duty. Start with the purchase agreement's disclosure schedules, the acquired company's hold log and its outside counsel.

The retention check asks whether law or contract may require keeping the records. IRS guidance in Rev. Proc. 98-25 treats machine-sensible records in an automated data processing system as records that must be kept so long as their contents may become material to tax administration, at a minimum until the limitation period for each tax year expires. Department of Labor guidance asks employers to keep payroll records for at least three years and records on which wage computations are based for two.

Contracts can pull the other way. Customer agreements sometimes require deleting customer data at termination, so a backup may hold records the company promised to destroy. Flag those for counsel rather than restoring them.

Restore a sample before deciding#

A sample restore is the cheapest way to replace guesses with facts. Tapes written by older backup software usually need that software's catalog, or a rebuild of it, and encrypted backups need their keys, so confirm both before estimating anything.

The inventory from a sample restore is also what a licensing fit check needs. System names, years of history and record families are metadata, so no files leave the isolated environment at that stage.

• 1Step 1: pick the backup sets most likely to hold retired systems, using labels, dates and any surviving IT notes.
• 2Step 2: confirm that drive hardware, backup software, catalogs and encryption keys are available.
• 3Step 3: restore into an isolated environment with logging and no path to production, and scan before opening anything.
• 4Step 4: record systems, record families, date ranges and whether records link requests to outcomes.
• 5Step 5: estimate the effort to restore the full set, then decide using the table above.

Illustrative: a consulting firm's tape shelf#

Illustrative: a fictional holding group acquires a management consulting firm and finds a shelf of LTO tapes plus a powered-down server that once ran an on-premises time and billing system. The portfolio CTO plans to clear the room during an office move.

The holdco's counsel confirms no active holds, but the finance team notes that some tax years remain open, so the billing database must be kept. A sample restore shows that the file server backups hold proposals, project review notes and internal playbooks, alongside client deliverables, while most other tapes duplicate a file share already migrated to SharePoint.

Decision: retain the billing database in a read-only archive, restore the proposal and project review folders for a later inventory with client deliverables flagged for exclusion, and destroy the verified duplicates with a certificate. Outcome: the room is cleared of what was truly redundant, and the firm's internal knowledge is preserved for a future licensing review.

Destroying backups properly#

Destroying backups properly means a documented decision and a verifiable method. Record what was destroyed, why, who approved it and how it was done, and keep the certificate of destruction with the integration file.

Use a sanitization method suited to the media, such as degaussing or physical shredding for tape and verified wiping or shredding for disks, follow a recognized media sanitization standard your security team already uses, and choose a vendor that issues certificates listing each cartridge or drive by serial number. An office move or hardware refresh is not a destruction decision; it is when unrecorded destruction usually happens.

How SourceX approaches legacy backups#

SourceX starts with metadata: system names, years of history, record families and known restrictions, gathered during the fit check without moving any files. Restored archives remain in the supplier's environment, or travel on encrypted drives when a delivery requires it, because SourceX never hosts multi-TB datasets.

In the SourceX five-step transaction, holds and retention duties are reviewed in the Rights step before any Preparation begins. The SourceX Evidence Packet records provenance, including which backup a package was restored from, so supplier and licensee share the same record of where the data came from.