PanicStation.org
UK USA
uk Technology & digital loss

What to do if…
cloud files are being moved to trash or deleted without your permission

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Do not empty any trash, bin, recycle bin, or recently deleted area. On a trusted device, secure the recovery email and cloud account, sign out other sessions, and pause syncing on devices you control. If deletions continue or the account is managed, contact the provider or account administrator now.

Do not do these things

  • Do not empty or permanently clear any deleted-files area.
  • Do not permanently delete suspicious files or close the cloud account.
  • Avoid restoring everything while files are still being deleted.
  • Do not change passwords on a device you believe may be compromised.
  • Do not use account-security or recovery links from unexpected messages.
  • Do not uninstall sync software, unlink the account, or factory-reset a device before recording what you can see and checking for unsynced local files.
  • Do not accuse someone with shared access before checking the available activity information.

What to do now

  1. Pause or quit the cloud-sync app on each device you control. If files are still disappearing and you cannot stop syncing, disconnect the suspected device from the internet without deleting local files or uninstalling the app.
  2. Using a device you trust, type the provider’s official address into the browser or open its official app. Check its trash, bin, recycle bin, recently deleted area, file activity, recent sign-ins, connected devices, authorised apps, and shared-folder activity where these are available.
  3. Take screenshots or notes showing affected file names, deletion times, unfamiliar devices, security alerts, shared-folder changes, and account-setting changes. Save these records somewhere that is not syncing with the affected account.
  4. Secure the email account used for cloud-account recovery. Check for unfamiliar forwarding rules, filters, recovery details, devices, and sign-ins, then change its password and enable two-step verification where available.
  5. Change the cloud-account password to a new, unique password. Change it on any other account where it was reused, sign out other devices and apps, remove unfamiliar authorised apps, and enable two-step verification or a passkey where available.
  6. If this is a work, school, charity, or other managed account, contact its IT or security administrator immediately. Ask them to preserve available activity records, review access, stop further deletions, and advise on recovery.
  7. Once the account is secured and no new deletions appear, restore one unimportant test file from the provider’s deleted-files area or version history. Check that it remains in place before restoring priority files in small batches.
  8. If many files are affected, the deleted-files area is empty, or files appear permanently removed, contact the provider through its official support pages promptly. Ask whether bulk restoration, rollback, version recovery, or another account-level recovery option is available for your account.
  9. Update the operating system, browser, cloud-sync app, and security software on suspected devices. Run an up-to-date security scan if the device supports one, then resume syncing one device at a time while watching for further deletions.
  10. Copy the most important recovered files to a separate trusted storage location that is not syncing with the affected account.

What can wait

You do not need to identify the exact cause, rebuild every folder, replace devices, change cloud provider, or redesign your long-term backup system now. First stop further loss, secure access, recover priority files, and keep a record of what happened.

Important reassurance

Recovery may still be possible because many cloud providers keep deleted files or earlier versions for a limited period, although the available options vary by provider and account type. Unexpected deletion can result from unauthorised access, shared-folder activity, a connected device, or syncing behaviour, so it is sensible to check the available records before deciding what caused it.

Scope note

This guide covers immediate containment, account security, and initial file recovery only. Further investigation, large-scale restoration, business incident response, or specialist data recovery may require help from the provider, an organisation’s IT team, or a cybersecurity professional.

Important note

This is general information, not professional cybersecurity, legal, data-recovery, or technical advice. Provider features, recovery periods, and support options vary and may change.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us