Recover Deleted Cloud Files

When files are deleted from a cloud sync folder, they are removed from the local disk and all synchronized endpoints. However, major cloud providers include multi-layered safety nets to prevent permanent data loss. Deleted files can be restored from local system bins, remote cloud trash consoles, or version history records.

This guide provides steps to sweep local systems, locate files in online portals, and perform restoration on both Windows and macOS.

---

1. Understand Cloud File Deletion Architecture

When you click delete in a synced folder, the deletion propagates in the following sequence:

1. Local OS Trash: The OS moves the file pointers to the local system Trash (macOS) or Recycle Bin (Windows).
2. Cloud Portal Trash: The sync client notifies the cloud server, which moves the online file to the cloud-level Recycle Bin (stores files for 30 to 93 days).
3. Local Deletion propagation: The server commands all other connected computers to delete their local copies of the file.
4. Second-Stage Recycle Bin (Enterprise): In corporate tenants, deleted items are held in an administrator-accessible second-stage archive for an additional period (e.g. 14 to 30 days) after being emptied from the user’s trash.

---

2. Recover from Local Recycle Bin and System Trash

If the file was deleted on the current computer, it may still reside in the local system trash bin.

A. Restore via Windows Command Line

To check and restore files programmatically from the Windows Recycle Bin:

1. Search for PowerShell in the Start Menu and open it.
2. Run the command to search for deleted cloud items:

   # Scan Recycle Bin for items matching cloud directories
   $Shell = New-Object -ComObject Shell.Application
   $Bin = $Shell.NameSpace(0x0a) # 0x0a represents Recycle Bin
   $Bin.Items() | Where-Object {$_.Path -like "*OneDrive*" -or $_.Path -like "*Dropbox*"} |
   Select-Object Name, Path, Size

Note: To restore a file from the PowerShell list, right-click the item in the standard desktop Recycle Bin and click Restore.

B. Locate and Sweep macOS Trash via Terminal

Identify deleted cloud files sitting in the macOS Trash container:

1. Open Terminal (via Spotlight).
2. Run the search command:

   # List files deleted from CloudStorage paths in Trash
   ls -la ~/.Trash | grep -iE "CloudStorage|OneDrive|Dropbox"

3. Move the file back to your home directory:

   # Restore file to user home directory
   mv ~/.Trash/stuck_file.txt ~/Documents/

---

3. Use Cloud Portal Version History and Restore Points

If files were deleted on another machine or overwritten by corrupt revisions, use online portals to restore previous versions.

A. Restore Overwritten Files using Web Version History

If a file was corrupted or saved over:

1. Log in to the web console of your cloud service (e.g. OneDrive, Google Drive, or Dropbox).
2. Right-click the target file and select Version History.
3. Locate the timestamp of the correct version.
4. Click the options menu next to the timestamp and select Restore or Download.

B. Perform OneDrive “Restore your OneDrive” Library Restore

If ransomware has infected your drive, or you need to revert a bulk deletion:

1. Go to OneDrive online > Settings (Gear Icon) > Restore your OneDrive.
2. Select a date from the dropdown menu (e.g., “Yesterday” or “Custom date and time”).
3. Use the slider to find the exact activity timeline before the deletions occurred.
4. Click Restore to revert all files in the library to their state at that time.

---

4. Perform Organization-Level Restores

For managed enterprise accounts (Microsoft 365 or Google Workspace):

• SharePoint Second-Stage Recycle Bin: If you empty the SharePoint Recycle Bin, administrators can access the Second-Stage Recycle Bin at the bottom of the page to retrieve files.
• Google Workspace Admin Console: Administrators can restore user Google Drive data deleted within the last 25 days:
  1. Navigate to admin.google.com > Users.
  2. Click the user name > More Options > Restore Data.
  3. Choose the date range and select Drive as the application.

---

5. Summary Quick Reference Checklist

Action Target	Operating System	Terminal Command / Path	Expected Outcome
Inspect Windows Trash	Windows	PowerShell shell object query	Locates deleted cloud files in the OS Recycle Bin.
Inspect macOS Trash	macOS	ls -la ~/.Trash	Identifies items deleted from local storage.
Version History	Web Console	File Options > Version History	Restores previous states of corrupted or overwritten files.
Bulk Restore Library	OneDrive Web	Settings > Restore your OneDrive	Reverts all library files to a specific point in time.
Admin Second Stage	SharePoint	Site Settings > Recycle Bin > Second Stage	Restores files emptied from user recycle bins.
Google Admin Console	Google Workspace	admin.google.com > Users > Restore	Restores Google Drive files deleted up to 25 days ago.