Track and see who and when a Google Drive file was deleted #
GAT+ is an Audit tool for your Google Workspace environment. It allows Admin to see everything that is happening on the domain.
In one of the sections in the Drive audit, an Admin can view all the Events for the files and folders.
For example, an Admin can track and see who and when a file was deleted.
Drive and Shared Drive – deletion #
- Drive files – Only owner can delete the file
- Shared Drive – Only those with Manager access to the Shared Drive can delete files permanently. Content Manager access members can move files and folders into the trash bin (but not permanently delete)
Below are steps for how this can be investigated:
Search events #
Open GAT+ and click on Drive audit.
From the top menu select the Events tab
This will show you all the “Events” that are happening to your Drive files.
Apply custom filter by clicking on the icon on the right side.
- Type equals Simple filter
- Under Definition
- Event equal Delete
Result #
The result will show all the Deleted Files.
The Email tab will show Who deleted the file.
The Email will show the person who deleted the File.
- File owner will be the same email as Files can be ONLY deleted by Owner.
- When the owner is Shared Drive (name with green background), the Email tab will show the person who deleted the File
- Shared Drive – only Managers and Content managers can delete files
Filters #
Additional filters can be applied for specific Files/Shared Drives – if needed to investigate who deleted them.
Delete events on Shared Drive #
Shared Drives – they can have multiple Managers and any of them can delete the file permanently.
To find the Manager who deleted the file apply the filter above.
- Shared Drive ID equal (the Shared Drive needed)
- Event equal Delete
This will allow you to view all files that have been deleted from the Shared Drive and the person (Manager) who deleted the files.
File owner equals to Shared Drive
- File owner = Shared Drive
- Email – person from the Shared Drive who deleted the file
An Admin can combine the filters and search for Events equal to Delete or Trash – to see all Deleted and Trashed files and who did the Deletion.
