If you have 10+ years of messy legacy file servers, the most scalable answer is not “move everything to a new file system” and not “put an LLM over the files.”
The scalable pattern is:
Discover → fingerprint → classify → enrich with metadata → govern → selectively migrate/index → continuously maintain
NIST’s current guidance is very aligned with this approach: automated discovery, identification, and labeling of unstructured data is the foundation for managing it at scale.
The architecture I'd recommend
LEGACY ESTATE
┌─────────────────────────────┐
│ NAS / SMB / NFS / file shares│
│ PDFs / Office / CAD / images │
│ archives / duplicates / junk │
└──────────────┬──────────────┘
│
1. DISCOVER
│
┌────────▼────────┐
│ Metadata Scanner │
│ + File Inventory │
└────────┬────────┘
│
2. FINGERPRINT
│
┌──────────────▼──────────────┐
│ Hash / dedupe / age / owner │
│ permissions / access history│
└──────────────┬──────────────┘
│
3. CLASSIFY
│
┌──────────────▼──────────────┐
│ Rules + ML + OCR + LLM │
│ │
│ • Sensitive? │
│ • Business-critical? │
│ • Record? │
│ • Duplicate? │
│ • Obsolete? │
│ • Document type/topic? │
└──────────────┬──────────────┘
│
4. METADATA
│
┌────────▼─────────┐
│ Data Catalog / │
│ Metadata Lake │
└────────┬─────────┘
│
┌───────────┼────────────┐
▼ ▼ ▼
DELETE ARCHIVE CURATE
│ │ │
│ │ ┌────▼─────┐
│ │ │ Search / │
│ │ │ RAG / AI │
│ │ └──────────┘
│ │
└───────────┴──────► GOVERN
1. Don't start by moving the files
This is probably the biggest architectural decision.
Inventory the estate in place first. Build a metadata index containing things like:
- Path
- File type
- Size
- Creation/modification/access dates
- Owner
- ACLs
- Share
- Department/business unit
- Hash/content fingerprint
- Duplicate relationships
- Sensitivity
- Document type
- Extracted text
- Entities/topics
- Retention category
- Business value
- Confidence score
This lets you make decisions about billions of files without repeatedly crawling and processing their contents.
NIST specifically demonstrates automated classification against network file shares and emphasizes consistent, automated classification for managing data at scale.
2. Separate metadata processing from content processing
This is critical for scalability.
Don't OCR or LLM-process every file on day one.
Instead:
Tier 0 — cheap scan
filename
path
size
timestamps
permissions
extension
owner
hash
This can cover essentially the entire estate relatively cheaply.
Tier 1 — deterministic analysis
duplicate detection
file-type identification
age
access frequency
known application formats
known retention rules
Tier 2 — content extraction
Only process files that matter:
PDF → text
DOCX → text + tables
PPTX → slides
XLSX → sheets/tables
images → OCR
CAD → specialized extraction
email → headers + body + attachments
Tier 3 — semantic enrichment
Then use ML/LLMs for the expensive stuff:
"What is this?"
"Which customer/project does it belong to?"
"Is this a contract?"
"Does it contain PII?"
"Is this a financial record?"
"Which business process does it support?"
This dramatically changes your economics.
You don't want to spend GPU/LLM money asking an AI to analyze a 14-year-old thumbs.db.
3. Make the metadata layer the real system of record
The files themselves should increasingly become data objects with metadata, rather than just paths on a NAS.
For example:
{
"object_id": "abc123",
"source": "\\\\server\\finance\\old\\contract.pdf",
"content_hash": "...",
"document_type": "vendor_contract",
"business_unit": "procurement",
"entities": {
"vendor": "Acme Corp",
"contract_id": "C-18271"
},
"sensitivity": "confidential",
"retention_class": "contract",
"owner": "procurement",
"created": "2015-03-14",
"last_accessed": "2021-08-17",
"duplicate_of": null,
"classification_confidence": 0.96,
"ai_allowed": true
}
That's much more useful than:
\\server07\misc\old\stuff\final_FINAL2.pdf
Modern enterprise AI architectures are increasingly treating metadata, lineage, ownership, sensitivity, and usage rules as the control layer around unstructured content.
4. Use a policy engine, not humans, for the first pass
You don't want a team of people opening 50 million files.
Build policies such as:
IF
last_accessed > 7 years
AND size < 50 MB
AND no legal_hold
AND duplicate = true
THEN
candidate_for_disposition
or:
IF
contains(SSN)
OR
contains(bank_account)
THEN
sensitivity = "restricted"
or:
IF
document_type = "contract"
AND
active_contract = false
THEN
retention_review = true
Then humans review exceptions and low-confidence decisions, rather than reviewing everything.
That's the fundamental scalability trick.
5. Use AI where it provides disproportionate value
LLMs are particularly useful for the "what the hell is this?" problem.
For example, a folder may contain:
final.pdf
final2.pdf
new.pdf
scan00043.pdf
old_contract.pdf
John stuff
Traditional metadata can't tell you much.
Semantic processing can potentially determine:
Document: Vendor Agreement
Vendor: Acme Corp
Effective date: 2017-04-01
Expiration: 2020-03-31
Contract value: $2.4M
Business owner: Procurement
Contains PII: No
Retention: 7 years
Status: Expired
But I'd use deterministic rules first and LLMs second, with confidence thresholds and human review for consequential classifications.
6. Don't automatically migrate everything
This is where many legacy modernization programs go wrong.
Your output should be something like:
| Category | Action |
|---|
| Active + valuable | Migrate |
| Active + sensitive | Migrate + tighten governance |
| Valuable but rarely accessed | Archive |
| Duplicate | Delete after validation |
| Obsolete | Dispose according to policy |
| Unknown | Human review |
| Legal hold | Preserve |
| AI-relevant | Extract/index |
| Low-value junk | Don't migrate |
The emerging best practice is essentially classification before migration: determine what matters before spending money moving and transforming everything.
7. For the processing infrastructure, use an event/batch architecture
At serious scale, I'd build around:
File shares
↓
High-throughput crawler
↓
Object/metadata queue
↓
Stateless workers
├── file identification
├── hashing
├── extraction
├── OCR
├── DLP/classification
├── entity extraction
└── LLM enrichment
↓
Metadata lake/catalog
↓
Search index + vector index
↓
Governance / migration / AI applications
Workers should be stateless and horizontally scalable.
That means going from:
100 TB → 1 PB → 10 PB
should primarily mean adding workers, rather than redesigning the application.
8. Don't build everything yourself
There are now commercial platforms specifically aimed at this problem—data discovery/classification, sensitive-data detection, file analytics, migration, and lifecycle management. NIST's 2026 work explicitly evaluates the use of commercially available classification technology for discovering and labeling unstructured data.
Depending on your environment, I'd evaluate products/platforms in categories such as:
- Microsoft Purview if you're heavily invested in Microsoft 365/Azure.
- Varonis for data discovery, permissions, and sensitive-data governance.
- BigID for discovery/classification/privacy.
- Komprise for large-scale file analytics, migration and tiering.
- Cohesity/NetApp/Dell ecosystem capabilities if your storage environment is already centered around them.
- Custom extraction + AI pipeline when you have unusual file types or need deep semantic processing.
The important point is that the platform should feed a common metadata/control plane, rather than becoming another isolated scanner.
What I'd do in a real enterprise
I'd implement it in five phases:
Phase 1 — Census
Scan everything without modifying anything.
Deliverable: "We have 640 TB, 1.8B files, 31% duplicates, 44% untouched for 5+ years, 7% containing potentially sensitive information."
Phase 2 — Classification
Automatically categorize the estate.
Deliverable: every object gets a classification, owner, confidence and disposition candidate.
Phase 3 — Remediation
Start with the easy wins:
- duplicates
- abandoned shares
- obsolete files
- excessive permissions
- obvious sensitive data exposure
Phase 4 — Curated data products
Build useful subsets:
Contracts
Engineering drawings
Customer documentation
Policies
HR documents
Product documentation
Financial records
Each becomes a governed, searchable corpus rather than a giant undifferentiated file dump.
Phase 5 — Continuous governance
The most important part:
Don't let the mess grow back.
New files should go through the same classification/metadata pipeline automatically.
The key design principle
I'd summarize the architecture as:
Don't build a better file server. Build a metadata intelligence layer over the file estate, then let that layer determine what happens to the files.
That's what makes the solution scalable.
And if the eventual goal is enterprise search, RAG, Copilot, or agentic AI, this becomes even more important: dumping 10 years of files into a vector database is generally the wrong architecture. You want curated, permission-aware, classified, deduplicated, provenance-preserving content going into the AI layer. Current enterprise AI guidance similarly emphasizes reusable pipelines for ingestion, extraction, metadata, quality, lineage, indexing, and controlled exposure.
If you're talking about hundreds of TB vs. multiple PB, or if these are primarily Windows SMB shares/NAS, I can also lay out a concrete reference architecture—including the crawler, metadata store, queue, OCR/LLM layer, search/vector database, and which commercial components I'd use at each layer.
The key design principle
I'd summarize the architecture as:
Don't build a better file server. Build a metadata intelligence layer over the file estate, then let that layer determine what happens to the files.
That's what makes the solution scalable.
And if the eventual goal is enterprise search, RAG, Copilot, or agentic AI, this becomes even more important: dumping 10 years of files into a vector database is generally the wrong architecture. You want curated, permission-aware, classified, deduplicated, provenance-preserving content going into the AI layer. Current enterprise AI guidance similarly emphasizes reusable pipelines for ingestion, extraction, metadata, quality, lineage, indexing, and controlled exposure.
4. Use a policy engine, not humans, for the first pass
You don't want a team of people opening 50 million files.
Build policies such as:
IF
last_accessed > 7 years
AND size < 50 MB
AND no legal_hold
AND duplicate = true
THEN
candidate_for_disposition
or:
IF
contains(SSN)
OR
contains(bank_account)
THEN
sensitivity = "restricted"
or:
IF
document_type = "contract"
AND
active_contract = false
THEN
retention_review = true
Then humans review exceptions and low-confidence decisions, rather than reviewing everything.
That's the fundamental scalability trick.
5. Use AI where it provides disproportionate value
LLMs are particularly useful for the "what the hell is this?" problem.
For example, a folder may contain:
final.pdf
final2.pdf
new.pdf
scan00043.pdf
old_contract.pdf
John stuff
Traditional metadata can't tell you much.
Semantic processing can potentially determine:
Document: Vendor Agreement
Vendor: Acme Corp
Effective date: 2017-04-01
Expiration: 2020-03-31
Contract value: $2.4M
Business owner: Procurement
Contains PII: No
Retention: 7 years
Status: Expired
But I'd use deterministic rules first and LLMs second, with confidence thresholds and human review for consequential classifications.
6. Don't automatically migrate everything
This is where many legacy modernization programs go wrong.
Your output should be something like:
| Category | Action |
|---|
| Active + valuable | Migrate |
| Active + sensitive | Migrate + tighten governance |
| Valuable but rarely accessed | Archive |
| Duplicate | Delete after validation |
| Obsolete | Dispose according to policy |
| Unknown | Human review |
| Legal hold | Preserve |
| AI-relevant | Extract/index |
| Low-value junk | Don't migrate |
The emerging best practice is essentially classification before migration: determine what matters before spending money moving and transforming everything.
7. For the processing infrastructure, use an event/batch architecture
At serious scale, I'd build around:
File shares
↓
High-throughput crawler
↓
Object/metadata queue
↓
Stateless workers
├── file identification
├── hashing
├── extraction
├── OCR
├── DLP/classification
├── entity extraction
└── LLM enrichment
↓
Metadata lake/catalog
↓
Search index + vector index
↓
Governance / migration / AI applications
Workers should be stateless and horizontally scalable.
That means going from:
100 TB → 1 PB → 10 PB
should primarily mean adding workers, rather than redesigning the application.
8. Don't build everything yourself
There are now commercial platforms specifically aimed at this problem—data discovery/classification, sensitive-data detection, file analytics, migration, and lifecycle management. NIST's 2026 work explicitly evaluates the use of commercially available classification technology for discovering and labeling unstructured data.
Depending on your environment, I'd evaluate products/platforms in categories such as: