IMP

Google Drive File Recovery: The Admin’s Ultimate 101 Guide

—

by

Khushal
in , ,

Become a Google Drive File Recovery PRO in minutes!

This guide is for administrators. You need a Google Workspace Admin account to perform most of the actions recommended below. 

”This important Google Drive file disappeared. How do I get it back, and why did it happen?” — A question we receive quite often from Google Workspace admins. 

If your company uses Google’s “Loch Ness monster” aka Google Drive, then it’s probably the spine that holds up your valuable data resources and powers other limbs of your organization’s operations.

Unfortunately, with all of the cross-employee collaboration happening there, especially within Shared Drives, it’s not uncommon for files to ‘seemingly’ go missing from your Google Drive repository.

This can bring in multiple Data loss and Information security concerns 

That’s why we created this simplified guide to help admins understand exactly what happened to those files, and how to recover them (if possible).

 

Let’s find that missing Google Drive File!

We’ll start with the most basic Google Drive File Recovery scenarios and build our way up to File recovery PRO

Recover a deleted file from the Trash The easiest most basic scenario: a user moved a file to the trash.

  1. Visit your Trash folder.
  2. Right-click on the file you’d like to recover  
  3. Click Restore.

Note: Files stay in the trash for 30 days before being automatically deleted. 

If the missing file isn’t in the Trash folder, then it may have been permanently deleted.

 

Recover Permanently Deleted Files in Google Drive

Did you say ‘Permanently’ deleted? — Is it gone forever? Luckily, no.

There’s a 25 Days File Recovery Window

Google Workspace Admins can recover permanently deleted Google Drive files and folders within 25 days of deletion from the Trash using the admin console. After that, deleted files are purged from Google’s systems.

To recover permanently deleted files simply follow these file recovery steps.

Note: Drive data is restored to the user’s Drive folder in the same location.

Using Google Vault? 

If your organization uses Google Vault you may be able to retrieve data older than 25 days (if it was subject to retention rules or holds).

In that case you can export the missing data, however, you can’t directly restore it to the user’s Drive. Read more.

 

Recover Files in Shared Google Drive 

Since files in Shared drives belong to ALL team members rather than a single individual, even if members leave, files stay exactly where they are for other team members to continue sharing the data.

However, it can sometimes get pretty messy — That’s why you need to pay attention to TWO key factors:

  1. File Ownership: When it comes to Drive file recovery, file ownership is a crucial factor (Checkout our blog: Manage Google Drive File Ownership like a Security PRO for more on that).
  2. Shared Drive(s) Structure: How you structure your organisation’s Shared Drive is also very important. It’s one of the first pillars to a complete Drive DLP strategy.

 

Deleting Files/ Folders in a Shared Google Drive

Depending on users’ access rights, they may be able to remove files stored in Shared Drives. That can result in Orphaned Drive files (harder to find), which we’ll discuss in more detail below. 

 

Noting yet? — Check your Google Drive Audit Log

Not sure if the file was deleted in the first place? Visit your Google Drive audit log, let’s see what you can find there.

This should provide you with information on users’ Drive activity, which may offer some insight on what happened to your missing file or folder.

You can also find information there on files automatically deleted by Google Drive or emptied from Trash.

You can also use GAT+ to locate files and folders across your entire ‘domain Drive’, and get more granular insights beyond those available in the admin console.

Finally, remember that for ‘My Drives’ users can easily check the ‘Drive activity panel’ to find out more on their missing files/ folders.

 

Check if it’s an Orphaned Drive File now

Sometimes, when you’ve exhausted all your options, it’s time to consider that the file may have been Orphaned.

Orphaned files are homeless files created when someone (NOT the file owner) deletes a shared file or folder in Google Drive. 

The file then loses its parent folder, becomes ‘homeless’ and thus harder to find. 

How to find and rehome Orphaned Files?

There are 3 Different ways to recover Orphaned Files:

  1. Know the file’s name? Search directly using the ”Drive Search”.
    • Go to Drive on a computer> log in with your Google account.
    • Go to Search> search for the file by entering its name. It will appear in the results of the search, even if it’s not in any folder.
    • You can then rehome it to any folder you choose.
  2. Don’t know the file’s name?  Use parameters in the Drive search.
    • Go to Drive on a computer> log in with your Google account.
    • Go to Search> search for the following special parameters: is: unorganized owner: me (By adding owner: me, only the files that you have created that are not in a folder will come out)
  4. Find Orphaned Files Using GAT+
    • GAT+ displays the folder structure for each user, this allows Admins to easily find all orphaned files for any user, group or OU. 

 

Recover Files from a Deleted/Closed Account

When an account that OWNS a Google Drive file is deleted, that file is deleted as well — even if it was shared with other domain users.

Perhaps the file belonged to a deleted or closed Google Workspace account.

Lost important files on a Google account that’s now closed? No problem, simply follow the steps outlined by Google here.

 

File Ownership vs Sharing in Google Drive

Finally, let’s look into why file ownership is a crucial factor to consider when searching for missing files in Google Drive.

Files are bound to their owners, not others with whom the file is shared with. Understanding file ownership helps you solve the bigger riddle better by knowing where exactly to look. 

A. File Ownership:

Every file (or folder) a user creates, syncs or uploads ‘They’ automatically become its Owner. As the owner, they can:

  1. Share it with other people.
  2. Permanently delete it from Google Drive.
  3. Control whether people can edit, comment on, or only view the file.
  4. Transfer ownership to someone else.

B. File Sharing:

Whenever a file (or folder) is shared in Google Drive, that file (or folder) still remains with the owner (on their Google Drive). 

Now if the owner deletes the file, it will be physically deleted from the Drive, and those users with whom the file is shared will no longer have access to it.

Contributors Can’t:

  1. Delete a file shared with them. Only the owner can delete the file for good.
  2. Recover a file shared with them that has been deleted by the owner.

What if someone shares a file with another user, that user adds it to their Drive, then later deletes it. Will it still be on their drive? ?

The answer is No. The file is still ‘owned’ by the person who created it. All they did there was reorganise the file in their own Drive, so it can still be found. That’s different from copying or downloading it. 

 

Finding Files that contain sensitive information in Google Drive

Using GAT+ an admin can find any document from the domain that contains sensitive data, here’s how.

This allows you to perform a search in Google Drive for all your domain users in bulk and find files that contain critical data to better manage and secure them.

10 more Ways GAT helps you better manage Google Drive file ownership and sharing:

  1. Replace current sharing permissions on your Google Drive files.
  2. Removing all permissions on Google Drive shares with an exception of a single user.
  3. Find publicly shared Google files.
  4. Search for specific File types in your domain and change their ownership in Google Drive.
  5. Manage files owned by leaving users easily.
  6. Remove All permissions to all sensitive folders and their sub-folders.
  7. Understand Google Group activity email and file sharing.
  8. Remove external shares when files haven’t been accessed for a certain number of days.
  9. Prevent MP3 files and other file types from being downloaded.
  10. Detect a sharing Policy Violation in Google Drive.

Well, That’s it for your 101 guide now. We hope you have found it helpful.

Have an admin-related Google Drive File Recovery question that we didn’t answer in this guide? Send it over to our experts, We’ll be happy to help you out.