What to do if…

A file or folder has disappeared

Look for a missing file first where it may have been moved, then in the versions and the recycle bin, and only after that in the backup. Hastily restoring an old copy over a folder that is still in use can wipe out files more recent than the backup.

Updated October 20263 min read5 sources cited

Key points

Search before restoring: search function, recycle bins (workstation, NAS, OneDrive, Drive), version history.
Cloud recycle bins have a limited lifetime: 93 days by default for OneDrive work accounts, 30 days for Google Drive.
Choose the most recent backup point where the file has a plausible size, not simply the most recent one.
Restore alongside, to a dedicated folder, then copy back: never overwrite an entire folder that is still in use.
If many files become unreadable at the same time, stop: it may be ransomware.

1. Check that the file has really disappeared

Search the server and workstations, including the Windows Recycle Bin, the NAS recycle bin, and the OneDrive or Drive bin.
A rename or a move to another folder. Ask the person what they did, without treating it as a fault: the answer saves an hour.
The versions of the file kept by Office, the NAS, OneDrive or Google, if the file is still there but empty or wrong. In that case it is not a disappearance, it is a version issue. Go back to yesterday’s version without touching the rest of the folder.
Ransomware getting started. If many files become unreadable at the same time, stop this procedure and isolate the network. See Ransomware has just struck.

How long do recycle bins keep files?

Recycle bins are a safety net, not a backup: they empty themselves, and a file permanently deleted by a user or an attacker does not always pass through them.

Location	Retention period	What you need to know
OneDrive (work or school account)	93 days	According to Microsoft, unless the administrator has changed retention
OneDrive (personal account)	30 days	Period stated by Microsoft
Google Drive	30 days	Automatic, permanent deletion afterwards, according to Google Help
Windows Recycle Bin, NAS recycle bin	Variable	Depends on the setting; a file deleted on a network share does not go through the workstation’s Recycle Bin
Backup	Retention subscribed	The only copy independent of the original tool

2. Choose the backup point

In the console, open the dates available for this path. Take the most recent one where the file still has a plausible size. A point from last night that already contains the file at 0 bytes is useless. A point from the day before yesterday may be the right one.

Note the date. It represents the amount of work to redo on this file: the RPO in this particular case.

3. Restore alongside, not over the top

Restore to a Restitution folder or to the person’s workstation, then copy the file to the right place. Restoring an entire folder “to the original location” in overwrite mode also brings back old versions of neighbouring files that had been updated since. That is the classic accident after the accident.

If the entire folder was deleted and nothing more recent exists, restoring in place is then the right move.

Open the restored file before declaring the incident closed. A restore that finishes without errors does not prove that the content is usable.

4. Understand why, in one sentence

Human deletion, cloud synchronisation, a script, a full quota that failed without an alert. If no backup exists for this path, that is where the gap lies: the folder was not within the scope. Add it the same day.

CERT-MU, in its guideline on backup plans, recommends defining what needs to be backed up, keeping an off-site copy and regularly testing restoration: this is exactly the scope that was missing. The French cybersecurity agency (ANSSI) also requires backups to be tested regularly; a file restored successfully today is a useful test, to be recorded as such. See How do you test that a backup works?.

At WeDoBack

WeDoBack can restore a single file or folder, without rebuilding the server, as of the date you choose. The points available are those of the retention subscribed, which the customer sets according to their storage volume: beyond that, there is no copy left. If the file had to be kept for years for accounting or regulatory reasons, it belonged in IMMUTABLE storage (up to 10 years), not in the working backup. Restoration requires the encryption key, held by the customer, to be available. Support (+33 9 72 50 78 28, from 9:00 to 13:00 and from 14:00 to 17:30, Paris time, i.e. from 11:00 to 15:00 and from 16:00 to 19:30 Mauritius time during European summer time, one hour later in winter) helps with restoration: with the SMART offer it is billed per intervention; with INTEGRAL, two hours per month are included.

Call +33 9 72 50 78 28 See offers and prices

Frequently asked questions

How long does a deleted file remain recoverable without a backup?

It depends on the tool. For a OneDrive work or school account, Microsoft states 93 days, unless the administrator has changed this setting. In Google Drive, the bin is emptied automatically after 30 days. On a file server or a NAS, it all depends on the network recycle bin and the snapshots configured. Beyond that, only an independent backup lets you go back.

Why not restore directly to the original location?

Because a restore in overwrite mode also brings back old versions of neighbouring files that had been modified since the backup. Restoring to a separate folder, then copying back only the file you need, avoids creating a second incident while fixing the first.

The file is not in any backup: what should I do?

First check that it is not in a local version or a recycle bin that is still active. If it really is missing, the folder was not within the backup scope. Add it the same day and check the very next day that it appears in the overnight backup.

Sources

Documents consulted in October 2026.

Restore files deleted from your OneDrive — Microsoft Support
Delete files in Google Drive — Google Drive Help
Guideline on devising a personal backup plan (CMSGu2017-03) — CERT-MU
Information system backup – The fundamentals (ANSSI-BP-100, v1.1, 27 November 2025, in French) — ANSSI (French cybersecurity agency)
Offers and prices — WeDoBack

Need help now?

Do not restore anything until you have identified a clean copy. We can guide you.

Call +33 9 72 50 78 28 or write to us

Dealing with an incident right now?

Our teams help you identify the right copy and restore it, Monday to Friday, 9 am to 1 pm and 2 pm to 5:30 pm (Paris time).

Call +33 9 72 50 78 28 Write to the team