First: where was the file located?

The recovery method depends on where the data was stored.

For example:

• personal OneDrive;
• SharePoint document library;
• a Teams channel, whose files are technically stored in SharePoint;
• a synchronised folder on your computer connected to the cloud via OneDrive.

1. Check the recycle bin

Deleted files from OneDrive and SharePoint usually first go to a recycle bin.

There you can often easily select and restore files and folders.

After restoration, the file normally returns to its original location.

How long do deleted files remain in the recycle bin?

In SharePoint Online and OneDrive for Business, deleted items are normally kept for a limited recovery period.

Within Microsoft 365, the total retention of the recycle bin is generally 93 days from the original deletion, unless other features or policies apply.

Deleted from the recycle bin as well?

SharePoint has a second-stage recycle bin.

When a user deletes an item from the first recycle bin, the item can still end up in the second-stage recycle bin.

This second recycle bin is mainly intended for site administrators and offers an additional recovery option.

However, the total retention period remains linked to the time the item was originally deleted.

File still exists but the content is incorrect?

Then you may not need to restore the file from the recycle bin.

SharePoint and OneDrive support version history.

This allows you to often view or restore an older version of a document.

This is useful, for example, when:

• data has been accidentally overwritten;
• an incorrect version was saved;
• someone made significant changes;
• an Excel, Word or PowerPoint file was corrupted.

4. An entire OneDrive is corrupted or massively changed

OneDrive also has options in supported business scenarios to roll back large numbers of changes.

This can be useful in cases such as:

• mass accidental changes;
• mass deletions;
• ransomware;
• a faulty synchronisation process.

5. What if an entire SharePoint site has problems?

For large-scale damage to a SharePoint site, additional recovery options exist depending on the incident and the available Microsoft 365 configuration.

Therefore, it is important not to immediately carry out all kinds of recovery actions yourself in a major incident.

What if I deleted a file locally on my computer?

That depends on the location.

If the folder is under OneDrive or a synchronised SharePoint library, the deletion may have been synchronised to Microsoft 365.

For example:

or a SharePoint library visible in Explorer via OneDrive.

Deleting in Explorer also deletes in the cloud

This is often misunderstood.

When a SharePoint library or OneDrive is actively synchronised, you are actually working in Explorer with the same files as in Microsoft 365.

If you delete a file there, that deletion is normally also synchronised to the cloud.

What if an employee deletes hundreds of files?

You must first determine exactly what happened.

Possible causes include:

• human error;
• an incorrect synchronisation action;
• a faulty script;
• a departing employee;
• a compromised account;
• ransomware.

IT may then also have to:

• investigate logins;
• review audit logs;
• block the involved account;
• revoke sessions;
• investigate the device;
• determine which recovery method is safest.

What if ransomware has modified the files?

When ransomware encrypts files, OneDrive can synchronise the changed files to the cloud.

Microsoft 365 contains various mechanisms that can support recovery, such as version history and recovery options for OneDrive.

But you must first prevent the cause from continuing to make changes.

Can IT see who deleted a file?

Microsoft 365 has auditing that can investigate many activities, depending on licence, configuration and retention periods.

In major incidents, IT can for example try to find out:

• which user performed an action;
• when the action took place;
• which files were affected;
• if there were suspicious logins;
• if there is a larger security incident.

And if the standard Microsoft recovery options are no longer sufficient?

Then it depends on the backup and retention solutions your organisation has set up in advance.

An additional Microsoft 365 backup can for example provide an extra recovery option outside the normal recycle bin and version history.

Why cloud storage is still much safer than a single local copy

The need for recovery procedures does not mean that working locally is safer.

On the contrary.

Properly managed SharePoint and OneDrive environments offer among other things:

• central storage;
• version history;
• recycle bins;
• rights management;
• auditing;
• retention capabilities;
• backup options;
• access from replacement devices.

What should you definitely not do?

• do not panic immediately and manually restore hundreds of files;
• do not keep synchronising if you suspect ransomware;
• do not recreate an entire folder structure before it is clear what has disappeared;
• do not wait weeks before reporting the problem;
• do not assume that a synchronised local copy is a backup.

When should you contact FLEXAMIT?

Be sure to get in touch when:

• you can no longer find the file in the normal recycle bin;
• many files have disappeared at once;
• an entire folder structure has disappeared;
• a user says they did not delete anything;
• you suspect ransomware;
• the incident involves a departing employee;
• important business data is affected;
• you are not sure which recovery action is safe.

Lost files?

Want to be sure in advance that recovery is possible?

Then do not wait until data is lost.

In summary