Scheduled Report for Deleted Files Across Google Drive #
You may want to create an audit report of the number of deleted files per week.
This report may show unusual activity or mass deletion. Google Workspace Admin Console allows you to recover deleted files within the last 25 days. Having the ability to detect mass deletion early can be helpful if a restore is required.
Set up a scheduled report #
Launch GAT+ using a Google Workspace Super Admin account or a GAT+ Delegated auditor account.
Navigate to Drive > Events > Apply custom filter
In the filter, fill in the details
- Type – Event type search
- Event type – Delete
- File type – Any (you can select any specific type if needed)
- Date (relative) – in the last x days – 7
Result of filter #
You can “click on apply” and view the result for all files deleted in the last 7 days.
The result will show the Event equal Delete along with all the metadata details.
Default Google action #
By default, when the file is deleted and is in the Bin/Trash in MyDrive, the file will be automatically deleted after 30 days.
Set up as a scheduled report #
Set up this as a scheduled report. Click on the scheduled report button and fill in the additional information required.
Alert rules for deleted files #
In GAT+, we also have Alert rules for deleted files.
It is available in GAT+ > Configuration > Alert rules > Drive alert
Result of the scheduled report #
Every day (occurrence time), this report will run and produce a Google Spreadsheet containing the details of the files deleted in the last 7 days.
Video #
FAQ #
Q: What kind of information can a scheduled report for deleted files provide?
A: This report can show you the number of deleted files, which can help in detecting unusual activity or mass deletions, and provide details about the deleted files and their metadata.
Q: How can I create a scheduled report for deleted files?
A: You can create one by going to GAT+ > Drive > Events, applying a custom filter with the “Event type” set to “Delete,” and then setting the “Date (relative)” to “in the last 7 days.” Once the filter is applied, you can set it up as a scheduled report.
Q: How long do deleted files remain in the Bin/Trash before they are permanently gone?
A: By default, a file that is in the Bin/Trash in MyDrive will be automatically and permanently deleted after 30 days.
Q: Are there other ways to be notified about deleted files besides a scheduled report?
A: Yes, GAT+ also has Alert rules for deleted files, which can be configured under GAT+ > Configuration > Alert rules > Drive alert.
