Track and see who and when a Google Drive file was deleted #
GAT+ is an Audit tool for your Google Workspace environment. It allows Admin to see everything that is happening on the domain.
In one of the sections in the Drive audit, an Admin can view all the Events for the files and folders.
For example, an Admin can track and see who and when a file was deleted.
Difference in Drive and Shared Drive file deletion #
- Drive files – Only the Owner can delete the files.
- Shared Drive – Only Managers of the Shared Drive can delete files permanently.
- Content Manager can move files and folders into the trash/bin (but not permanently delete the file)
Below are the steps for how this can be investigated:
Search events #
Navigate to GAT+ > Drive > Events (top bar)
As a result, you will see all the Drive events reported for your Google Workspace domain. A default filter for the last 7 days will be applied.
View the delete events #
Apply a custom filter by clicking on the icon on the right side.
- Type equals Simple filter
- Under Definition
- Event equal Delete
Result #
The result will show all the Deleted Files in the default selected 7-day time frame. You can select any other time frame needed.
The Email field will represent the person who deleted the File.
For the My Drive file, the Email and File owner will be the same, as only the owner can delete the file; the only person who can execute the “delete” event for the file.
When the “owner” is the Shared Drive itself (green background), the email address will represent the person/email address who executed the event of “delete”.
Additional filters #
Additional filters can be applied for specific Files/Shared Drives – if needed to investigate who deleted them in more detail.
Delete events on the Shared Drive #
Shared Drives – they can have multiple Managers, and any of them can delete the file permanently.
To find the Manager who deleted the file, apply the filter below
- Shared Drive ID equals (Shared Drive ID)
- Event equal Delete
This will allow you to view all files that have been deleted from the Shared Drive and the person (Manager) who deleted the files.
File owner equals to Shared Drive
- File owner = Shared Drive
- Email – person from the Shared Drive who deleted the file
When the email is “system,” it means the file was automatically deleted after 30 days staying in the trash/bin. This is the default behaviour from Google, where the bin/trash is automatically permanently deleted after 30 days.
An Admin can combine the filters and search for Events equal to Delete or Trash – to see all Deleted and Trashed files and who did the Deletion.
Conclusion #
In summary, this article outlined a straightforward, three-step process using GAT+ to audit file deletions in your Google Workspace.
The process involves navigating to the GAT+ > Drive > Events section, applying a custom filter (DefinitionEvent equal Delete) to isolate deletion records, and then reviewing the results (Email field) to see who executed the delete action and when it occurred. This provides immediate, clear visibility into your domain’s file lifecycle management.
FAQ #
- How do I see who deleted a file?
- The person who deleted the file is shown in the Email field of the event result.
- For My Drive files, the Email field and the File Owner will be the same person.
- For Shared Drive files, the Email field shows the Manager who executed the delete action.
- The person who deleted the file is shown in the Email field of the event result.
- Why does the ‘Email’ field sometimes show “system”?
- If the Email field shows “system”, it means the file was permanently deleted automatically after sitting in the trash/bin for 30 days. This is the default setting for Google’s auto-purge function.
