Can another user retain a copy of a deleted shared file?¶
Yes. Another user may retain a copy of a shared file after the original is deleted.
The dangerous assumption is that deleting the source file removes every copy held by everybody who had access.
What this means in practice¶
A user may have downloaded the file, synchronised it to a device, copied it into another folder, attached it to a message or exported it into another service. Those copies may remain even when the original owner deletes the cloud version.
A shared workspace may also create separate copies through duplication, versioning or offline access.
Investigators should identify who had access before deletion, what permissions they held and whether the provider recorded downloads, copies, exports or synchronisation.
Also consider whether the file was forwarded outside the service. The provider may no longer have visibility once the content leaves its environment.
What this does not show on its own¶
The absence of a copy from one user’s account does not prove they never possessed it. It may have been deleted locally, moved elsewhere or retained on another device.
Where the file is important, preserve the sharing and access history quickly. Current permissions may not reveal who had access at the relevant time.
What to do next¶
Check shared links, folder membership, version history, audit logs and connected devices.
Do not assume that all users received the same version. One person may hold an older copy while another downloaded the latest version before deletion.
Key takeaway
Deleting a shared cloud file does not remove copies already downloaded, synchronised or exported by other users, so trace access and distribution before concluding the content is gone.