A company in liquidation had one thing left to wind down: the Google Cloud organisation behind its former fitness app. Before anything could be switched off, everything in it had to be found, copied to an independent archive and handed over to a hosting partner, who would make it searchable for the liquidator.
The problem
Nobody still at the company knew exactly what was in there. Years of development had left 25 cloud projects, 19 storage buckets, two app databases, a login service and a large analytics export. Some of it was empty, some of it held years of workout data, and some of it held personal data of former app users, including body measurements, which count as health data under the GDPR.
The archive had to be complete, because whatever is not copied is gone once the cloud account closes. And it had to be provably complete, because a liquidator cannot sign off on "we think we got everything".
What we did
- Look before touching. A read-only inventory listed every project, bucket, database, table and running service. For personal data we only recorded field names, types and counts, never the contents. That gave the liquidator a clear picture of what kind of data existed before a single file moved.
- Copy everything, transform nothing. Files were copied 1:1 into an EU archive store. Databases and login accounts were exported as lossless text files, one per collection or table, with their schema next to them. Password hashes were left out on purpose.
- Check every file. After copying, every file was read back from the archive and compared with the checksum the source had recorded. A manifest lists what is where.
- Expect the tools to fail. The browser-based cloud shell reset twice in the middle of the large copy. We moved the rest of the work to a small temporary virtual machine, which finished the remaining 240 GB in about an hour, and stopped it once the job was done.
The result
- 91,537 of 91,537 files verified by checksum, about 345 GB in total.
- 4,407 of 4,407 database and export files verified the same way.
- Zero mismatches, zero missing files, and no file in the archive that isn't in the manifest.
- All temporary access rights expire automatically at the end of the year, and every one of them has a written rollback step.
One finding surprised everyone: the app had been removed from both app stores and its website was down, yet new accounts were still being created. They came from copies of the app that were still installed on people's phones. Switching off sign-ups became the first decision on the liquidator's list.
What we took away
When you close down a system, the verification is the deliverable. A copy nobody has checked is only a hope. A copy with a manifest and a matching checksum for every file is something you can hand over and sign off.