What should I check if cloud data appears to have been deleted?¶

If cloud data appears to have been deleted, first establish what was deleted, from which service, by which account or system and whether the item still exists elsewhere.

Evidential caution: that deletion means the data has gone completely.

What this means¶

A deleted file, message or account may remain in a recycle bin, deleted-items area, version history, archive, backup, synchronised device or another user’s copy.

The provider may also retain audit, sharing and access records after the content disappears from the user interface.

Review audit logs, administrator records, retention policies, legal holds and backup arrangements.

Where recovery is necessary, document the method, account, device, time and resulting changes.

The item may also have been moved, renamed or recreated rather than deleted.

Where the provider has a defined recovery window, record its expiry and ownership of the next action. Delay can turn a recoverable item into an unavailable one.

Where deletion may have been automated, preserve the retention policy and execution records. The disappearance may reflect system rules rather than a deliberate user action.

What to check or do next¶

• Start by preserving the current state.
• Record the account, tenant, resource ID, filename or message ID, deletion time, time zone and any visible recovery period.
• Check who had access before deletion and whether the item was shared, downloaded, copied or synchronised.
• Do not restore the item casually. Restoration may create new events, alter timestamps or alert users.

Evidential limits¶

Absence from one location does not prove absence everywhere.