Storage Tiering Service  ·  View 05 of 31  ·  2 · People and journeys

Journey: Recall Seven Years of One Custodian

Legal operations needs 1.8 million files by a court date. 700,000 of them are on tape, and the tenant's retrieval budget says no.

Editable source SVG draw.io All views
Legal operations litigation support Goal — 1.8 M files for one custodian in the review tool by Friday Trigger — Court order with a ten-day production deadline Done when — Every object staged, every charge attributed 1 · Request 2 · Authorise ◆ moment of truth 3 · Plan 4 · Wait ◆ moment of truth 5 · Review 6 · Close What they do Names custodian + range Cites the court order Reads ETA per tier Watches progress Exports to review tool Releases staging System behind it Recall API Budget authority Quota planner Tape library Staging bucket Charge ledger How it feels Calm Watchful Worried Where it hurts Tenant budget would refuse 31 cartridges, 6 drives ETA slips by 5 h 48 h TTL too short What the platform gives One job, not 1.8 M reads Legal authority, logged Grouped by pack and tape ETA republished honestly TTL extended per job Unread bytes reported Journey — Legal Operations Recalls Seven Years of One Custodian v 1.0 · owner Storage Platform Architecture · date 2026-09

The worst moments

  • Authorise. A tenant retrieval ceiling that exists to stop a runaway export would, applied blindly, stop a court-ordered production. The platform must not choose between a budget and a legal obligation by accident.
  • Wait. 2,300 packs on 31 cartridges with six drives available. The estimate slips by five hours when an interactive recall takes a drive. What hurts is not the delay but finding out late.

What the architecture owes this journey

  • A legal authority separate from tenant budgets: never refused, always attributed, approved by a named person (ADR-27).
  • Planning by pack and by cartridge, with CTA ordering retrievals by tape position, so 0.7 million objects cost 2,300 stages rather than 0.7 million (ADR-26).
  • A published estimate that is revised when it changes, and a report of every staged byte nobody read.

Assumption

  • Legal holds already cover this custodian, so none of the archived objects can have moved during the proceedings. The recall only reads.