Your expert in backup and data protection!The solution tailored to your needs
What to do if…
A file or folder has disappeared
Look for a missing file first where it may have been moved, then in the versions and the recycle bin, and only after that in the backup. Hastily restoring an old copy over a folder that is still in use can erase files that are more recent than the backup.
Key points
- Search before restoring: search tools, recycle bins (workstation, NAS, OneDrive, Drive), version history.
- Cloud recycle bins keep files for a limited time: 93 days for OneDrive work accounts by default, 30 days for Google Drive.
- Choose the most recent backup point where the file has a credible size, not simply the most recent one.
- Restore alongside, into a dedicated folder, then copy back: never overwrite an entire folder that is still in use.
- If many files become unreadable at the same time, stop: it may be ransomware.
1. Check that the file has really disappeared
- Search the server and workstations, including the Windows Recycle Bin, the NAS recycle bin and the OneDrive or Drive bin.
- A rename or a move to another folder. Ask the person what they did, without making it a matter of blame: the answer saves an hour.
- The versions of the file kept by Office, the NAS, OneDrive or Google, if the file is still there but empty or wrong. In that case it is not a disappearance, it is a version issue. Go back to yesterday’s version without touching the rest of the folder.
- Ransomware getting started. If many files become unreadable at the same time, stop this procedure and isolate the network. See Ransomware has just struck.
How long do recycle bins keep files?
Recycle bins are a safety net, not a backup: they empty themselves, and a file permanently deleted by a user or an attacker does not always pass through them.
| Location | Retention period | What you need to know |
|---|---|---|
| OneDrive (work or school account) | 93 days | According to Microsoft, unless the administrator has changed the retention |
| OneDrive (personal account) | 30 days | Period stated by Microsoft |
| Google Drive | 30 days | Automatic, permanent deletion afterwards, according to Google Help |
| Windows Recycle Bin, NAS recycle bin | Variable | Depends on the setting; a file deleted from a network share does not go through the workstation’s recycle bin |
| Backup | Retention subscribed | The only copy independent of the original tool |
2. Choose the backup point
In the console, open the dates available for that path. Take the most recent one where the file still has a credible size. A point from last night that already contains the file at 0 bytes is of no use. A point from the day before yesterday may be the right one.
Write down the date. It represents the amount of work to redo on that file: the RPO for this case.
3. Restore alongside, not over the top
Restore to a Restored folder or to the person’s workstation, then copy the file to the right place. Restoring an entire folder “to the original location” in overwrite mode also brings back old versions of neighbouring files which, for their part, had been updated since. It is the classic accident after the accident.
If the entire folder was deleted and nothing more recent exists, restoring in place is then the right move.
Open the restored file before declaring the incident closed. A restore that completes without errors does not prove that the content is usable.
4. Understand why, in one sentence
Human deletion, cloud synchronisation, a script, a full quota that failed without an alert. If there is no backup of that path, that is where the gap lies: the folder was not within the scope. Add it the same day.
Good-practice guides recommend starting by listing where data is stored and which data could not be found anywhere else: that is exactly the inventory that was missing. The ANSSI, France’s national cybersecurity agency, for its part requires backups to be tested regularly; a successful file restore today is a useful test, to be recorded as such. See How do you test that a backup works?.
At WeDoBack
WeDoBack can restore a single file or folder, without rebuilding the server, as of the chosen date. The points available are those of the subscribed retention, which customers set according to their storage volume: beyond that, there is no longer a copy. If the file had to be kept for years for accounting or regulatory reasons, it belonged in IMMUTABLE storage (up to 10 years), not in the working backup. Restoration requires the encryption key, held by the customer, to be available. Support (+33 9 72 50 78 28, from 9:00 to 13:00 and from 14:00 to 17:30, Paris time) helps with restoration: with the SMART offer, it is billed per intervention; with INTEGRAL, two hours per month are included.
Frequently asked questions
How long does a deleted file remain recoverable without a backup?
It depends on the tool. For a OneDrive work or school account, Microsoft states 93 days, unless the administrator has changed this setting. In Google Drive, the bin is emptied automatically after 30 days. On a file server or a NAS, it all depends on the network recycle bin and the snapshots configured. Beyond that, only an independent backup lets you go back in time.
Why not restore directly to the original location?
Because a restore in overwrite mode also brings back old versions of neighbouring files that had been modified since the backup. Restoring to a separate folder, then copying back only the file you need, avoids creating a second incident while fixing the first.
The file is not in any backup: what should I do?
First check that it is not in a local version or a recycle bin that is still active. If it really is missing, the folder was not within the backup scope. Add it the same day, and check the very next day that it appears in the overnight backup.
Further reading
Sources
Documents consulted in October 2026.
- Restore files deleted from your OneDrive — Microsoft Support
- Delete files in Google Drive — Google Drive Help
- Cybersecurity guide for SMEs (June 2021) — ENISA
- Information system backup – The fundamentals (ANSSI-BP-100, v1.1, 27 November 2025, in French) — ANSSI (French agency)
- Offers and prices — WeDoBack
Need help now?
Do not restore anything until you have identified a clean copy. We can guide you.
Call +33 9 72 50 78 28or write to usDealing with an incident right now?
Our teams help you identify the right copy and restore it, Monday to Friday, 9 am to 1 pm and 2 pm to 5:30 pm (Paris time).