Cyber Security ChecklistsChecklist and Guide

OneDrive and SharePoint Deleted File Recovery Checklist

7 minutes to completeEvergreen guide — kept up to date

A practical checklist for use immediately after a OneDrive, SharePoint or Teams file disappears. Covers identifying the storage location, checking the correct Recycle Bin, using version history and OneDrive Restore, containing security incidents and documenting the outcome.

A OneDrive, SharePoint or Teams file has disappeared? Use this checklist before recreating files, emptying Recycle Bins or resetting the affected computer.

Following Microsoft’s MC1269861 change (rolled out from May 2026), files deleted from OneDrive or SharePoint online may no longer appear in the Windows Recycle Bin on a synchronised computer. Check the online Recycle Bin first.

Step 1 — Identify the Storage Location

□ Personal OneDrive (Microsoft consumer account)
□ OneDrive for Business (work or school account)
□ SharePoint library
□ Teams channel (files stored in SharePoint)
□ Teams chat (files may be in sender’s OneDrive)
□ Local unsynchronised folder
□ Network drive

Step 2 — Check Online

□ Open the location in a browser
□ Search for the filename
□ Check the original folder
□ Check whether the item was moved or renamed

Step 3 — Check Recycle Bins

□ OneDrive online Recycle Bin
□ SharePoint first-stage Recycle Bin
□ SharePoint second-stage Recycle Bin (ask an authorised site collection administrator)
□ Windows Recycle Bin where relevant (local deletions only)
□ Do not empty any Recycle Bin during recovery

Step 4 — Check Other Recovery Options

□ Version history — only if the file still exists but its content is wrong
□ OneDrive Restore — for widespread changes, mass deletion or ransomware
□ Purview retention — requires administrator or compliance access
□ Departed-user recovery — if the file belonged to a former employee
□ Microsoft 365 backup
□ Endpoint or network backup

Step 5 — Check the Scale

□ One file
□ One folder
□ One user
□ One SharePoint site
□ Multiple users affected
□ Continuing or unexplained deletions

If multiple users are affected or deletions are continuing, treat it as a possible security incident. Do not attempt recovery before containment.

Step 6 — Contain

□ Pause unnecessary synchronisation where advised
□ Isolate compromised devices from the network
□ Secure or disable compromised accounts
□ Preserve logs and evidence
□ Stop restoring until the cause is controlled

Step 7 — Restore and Verify

□ Restore to the correct location
□ Open the restored file
□ Check content
□ Check version
□ Check permissions
□ Check sharing links
□ Confirm users can access it

Step 8 — Record and Prevent

□ Record what disappeared, where it was stored and who made the deletion
□ Review permissions and delete access rights
□ Review alerting and monitoring
□ Confirm backup scope
□ Test restoration
□ Update staff guidance

A synchronised file is part of the live data set. It is not automatically an independent backup. Last checked: 31 July 2026.

Plain-English Takeaway

If a cloud file disappears, check the online Recycle Bin first. The Windows Recycle Bin may no longer hold a copy of cloud-deleted files. Act quickly — recovery windows expire. Synchronisation is not backup.

Downloadable guide

Download the Deleted File Recovery Checklist

A printable A4 PDF with an eight-step recovery checklist for deleted OneDrive, SharePoint and Teams files, including a recovery-location comparison table and sync vs backup guidance.

Download Checklist

Free download. No email address required.

Want the full business explanation?

The Technology Intelligence article covers why this matters, where it helps and what to watch out for.

Read the full Technology Intelligence article

Related Knowledge Centre resources

Microsoft Office Unsaved File Recovery Checklist

Recover unsaved Word, Excel and PowerPoint files using AutoRecover, Document Recovery and Microsoft 365 recovery options.

View guide

Business Backup Checklist

Confirm what is backed up, where it goes and who checks that it works.

Coming Soon

Cyber Resilience Readiness Guide

Review your critical systems, IT suppliers, incident response, backups and business-continuity arrangements.