SharePoint File Recovery

Losing files due to accidental deletion, file corruption, local sync overwrite, or ransomware encryption is a common issue in collaborative environments. SharePoint Online provides robust, multi-layered data recovery mechanisms that allow users and administrators to restore lost items.

This guide outlines how to navigate SharePoint’s first and second-stage recycle bins, use the library restore feature, revert documents using Version History, and execute bulk recovery using PowerShell.

1. Understand SharePoint File Recovery Options

SharePoint Online provides several lines of defense to recover data, with retention periods and capabilities varies by action:

• First-Stage Recycle Bin: When a user deletes a file, it is moved to the site Recycle Bin. It remains here for 93 days (shared with the Second-Stage bin).
• Second-Stage Recycle Bin: If a user empties the first-stage bin, items move to the Site Collection (Second-Stage) Recycle Bin. Only Site Collection Administrators can view and restore these items.
• Version History: If a file is overwritten or corrupted, SharePoint maintains historical major (and optionally minor) versions that can be restored individually.
• Files Restore (Library Level): Site owners can roll back an entire document library to any specific point in time within the last 30 days. This is the primary defense against mass deletions or ransomware attacks.
• Local Recycle Bins: If the files were deleted via a synced desktop folder, copies may also reside in the Windows Recycle Bin or macOS Trash.

2. Recover Files from SharePoint Recycle Bins

If a file is missing, the first place to check is the web-based Recycle Bin.

Step 1: Recover from the First-Stage Recycle Bin

1. Go to the SharePoint site where the file was stored.
2. In the left-hand navigation pane, click Recycle bin. (If it is not visible, go to Site contents → Recycle bin in the top right).
3. Select the checkmark next to the files or folders you want to recover.
4. Click Restore in the top menu bar. The files will return to their original locations.

Step 2: Recover from the Second-Stage Recycle Bin (Admins Only)

If the file was deleted from the first-stage bin:

1. Navigate to the Recycle bin page on the SharePoint site.
2. Scroll to the bottom of the page and click the link: Second-stage recycle bin (requires Site Collection Admin rights).
3. Locate the files, select them, and click Restore.

3. Restore Site Libraries via Site Restore

If a ransomware attack occurs or a large-scale folder structure is corrupted, Site Owners can roll back the entire library.

1. Navigate to the SharePoint document library you wish to restore.
2. Click the gear icon (Settings) in the top-right corner.
3. Select Restore this library.
4. On the restore page, select a date range from the dropdown (e.g., Yesterday, Custom date and time).
5. Use the activity chart to identify the exact point in time before the corruption or deletion occurred.
6. Click Restore to revert the entire library to that timestamp.

4. Restore Previous Versions using Version History

If a file has been corrupted or saved with unwanted modifications, you can restore a previous version.

Via Web Browser:

1. Hover over the file in your SharePoint library, click the three vertical dots (Show Actions).
2. Select Version History.
3. In the dialog box, hover over the timestamp of the version you wish to restore, click the dropdown arrow next to it, and select Restore.
4. Click OK to confirm. This action creates a new version that is an exact copy of the restored state.

# Install PnP PowerShell
Install-Module -Name PnP.PowerShell -Scope CurrentUser -Force

# Connect to the SharePoint site
Connect-PnPOnline -Url "https://yourtenant.sharepoint.com/sites/site-name" -Interactive

Step 2: Audit and Bulk Restore Items

Run this script to search the recycle bin and restore items by file extension, deletion date, or deleting user:

# 1. View all items in the first and second-stage recycle bins
Get-PnPRecycleBinItem | Select-Object Title, DirName, ItemType, DeletedByEmail, DateDeleted

# 2. RESTORE ALL .docx FILES deleted within the last 7 days
$DateLimit = (Get-Date).AddDays(-7)
Get-PnPRecycleBinItem | Where-Object {
    $_.Title -like "*.docx" -and $_.DateDeleted -gt $DateLimit
} | Restore-PnPRecycleBinItem -Force

# 3. RESTORE ALL items deleted by a specific user email
Get-PnPRecycleBinItem | Where-Object {
    $_.DeletedByEmail -eq "user@company.com"
} | Restore-PnPRecycleBinItem -Force

6. Summary Checklist for File Recovery