Deleted File Recovery

How to Investigate Unexpected OneDrive File Deletions and Audit Logs

Chanuka Geekiyanage Oct 22, 2026 869 views

Question details

The user needs to investigate the unexpected mass deletion of thousands of OneDrive files where file metadata blames a specific user, but audit logs show zero activity for that user during the timeframe.

How to Investigate Unexpected OneDrive File Deletions and Audit Logs

Product: Microsoft OneDrive / Microsoft Purview
Device & OS: not provided
Scenario: Investigating unprompted mass file deletions across multiple OneDrive folders to determine if they were caused by malware, automation, compromised credentials, or sync client errors.
Observed behavior: File details show a specific user deleted approximately 2,000 files, but audit logs yield zero activity results for that user during the deletion period, creating conflicting evidence.

Before you start

Before attempting to restore the files, preserve all evidence by documenting timestamps and pausing any automated synchronization clients on the affected devices to prevent further unintended data loss.

Solution 1Recommended

Investigate Using Microsoft Purview Audit Logs

Run an advanced audit search using a wildcard URL to capture all file activity details and identify the true source of the deletions.

Conflicting file metadata and audit logs often happen when queries are too narrow. Using a wildcard search ensures that activity in all subfolders is captured accurately.

Access Purview Compliance Portal

Log into the Microsoft Purview compliance portal with administrative credentials and navigate to the 'Audit' section.

Set the Date Range

Adjust the UTC date and time range to accurately cover the period when the massive file deletion occurred.

Use a Wildcard URL

In the search query for File, folder, or site, enter the affected OneDrive URL and append a wildcard symbol (*) at the end (e.g., https://domain-my.sharepoint.com/personal/user_domain/*).

Filter by File Operations

Under 'Activities', specifically select 'FileDeleted' and 'FileRecycled' to narrow the results to deletion events.

Run and Export the Report

Click 'Search' to run the audit. Once complete, export the results to cross-reference the IP addresses and user agents tied to the deletion events.

Investigate Using Microsoft Purview Audit Logs

Missing Audit Data: If the query still returns zero results, the deletions may have been triggered by backend retention processing or an administrative action rather than standard user interaction.

Solution 2

Secure Accounts and Verify Sync Clients

Rule out malware, compromised credentials, or malfunctioning sync applications that can cause automated mass deletions.

Solution 3

Restore Files and Escalate to Support

Recover the missing data from the recycle bin and open a Microsoft support ticket if the root cause remains hidden.

Free Microsoft Office alternative

Looking for a Secure and Reliable Office Alternative? Try WPS Office

While investigating complex enterprise cloud storage and audit log issues, you may want a lightweight, easy-to-manage office suite for your daily tasks. WPS Office provides excellent local document management, native compatibility with Microsoft formats, and straightforward cloud backup options without heavy administrative overhead.

Fully compatible with Microsoft Word, Excel, and PowerPoint file formats.Includes built-in WPS Cloud for simple, secure file storage and easy version history recovery.Lightweight installation with a familiar, user-friendly tabbed interface.Free to download and use for your daily personal and professional document processing.

microsoft office alternative - wps office

Frequently Asked Questions

Why do file details show a user deleted files, but Microsoft Purview Audit logs show no activity?

This discrepancy often happens if files were deleted via backend retention processing, automated sync client errors, or third-party applications rather than manual user interaction. It can also occur if your audit query is too narrow; always ensure you use a wildcard (*) at the end of the OneDrive URL in your search.

How can I quickly recover thousands of deleted OneDrive files at once?

If you have a Microsoft 365 subscription, you can use the 'Restore your OneDrive' feature found in the OneDrive settings menu. This allows you to roll back your entire OneDrive to a specific point in time within the last 30 days, effectively undoing mass deletions without selecting files manually.

What specific operations should I look for in the Purview Audit log for missing files?

When filtering the audit log for missing data, look specifically for the 'FileDeleted' and 'FileRecycled' operations. This will help you track when items were moved to the user's recycle bin or permanently removed from the system.

Migration & Recovery