Overview

Purpose of this guide

This guide explains how to configure and use Data Archival in ADAudit Plus — the feature that ages out audit data from the live database into long-term storage to reclaim disk space, and the companion features that let you bring that data back for reporting or search:

1. Configure how long audit data from each report category stays in the Hot, Cold, and Frozen states.

2. Configure where archived data is stored and how long deleted data can still be recovered.

3. Restore (load) archived data back into ADAudit Plus reports when you need to review it.

4. Search across archived data without doing a full restore, using the archive index.

Data Archival spans all five ADAudit Plus audit categories — Identity, Cloud, Data, Infrastructure, and Endpoints — because every report category ages through the same Hot/Cold/Frozen lifecycle. This guide is not category-specific.

Note: This guide covers data lifecycle management (aging, archiving, restoring, searching) — not backup and disaster recovery. For backing up the ADAudit Plus database and archive storage, see the Backup and Restore Guide.

What is Data Archival

As ADAudit Plus continuously collects audit data, the live database grows and older data becomes less frequently accessed. The Data Archival feature manages this growth by moving audit data through progressively more compressed storage states based on rules you define per report category.

Why archive audit data:

• Reclaim disk space and control database growth on the live database.
• Retain historical audit data for long-term reporting and trend analysis.
• Support log forensics and compliance investigations using previous years' audit data.

Data lifecycle: Hot, Cold, and Frozen states

Audit data in ADAudit Plus moves from the Live Tier to the Archive Tier as it ages. The Live Tier holds data in the Hot state; the Archive Tier holds data in compressed form in the Cold and Frozen states.

Tier	State	Description	Searchable	Relative Disk Usage
Live Tier	Hot	Most recent audit data, accessed frequently	✅ Yes	Highest (baseline, ~630 MB avg.)
Archive Tier	Cold	Compressed, indexed audit data, accessed less frequently	❌ No — requires restore or Archived Data Search	~50% less than Hot (~300 MB avg.)
Archive Tier	Frozen	Compressed, raw audit data, accessed rarely	❌ No — requires restore	~80% less than Hot (~115 MB avg.)

Note: Based on your security and compliance requirements — and depending on how often each report category is accessed — you configure how long data from each category stays in each state.