You may want to create an audit report of the number of deleted files per week. This report may show unusual activity or mass deletion. Google Workspace Admin Console allows you to recover deleted files within the last 25 days. Having the ability to detect mass deletion early can be helpful if a restore is required.
Report Set Up #
Launch GAT+ using a Google Workspace Super Admin account or a GAT+ Delegated auditor account.
Navigate to Drive audit menu. Enter the Event tab. Make sure to reset/clear existing custom filter.
Next click on the Custom filters button.
Then select the following filter search operators;
Event type set to Delete
and events that occurred in the Last 7 days. Then Schedule this filter.
Set the following settings for the scheduled custom filter.
Outcome #
Everyweek this report will run and produce a Google Spreadsheet containing the details of the files deleted in the last 7 days.
