PanicStation.org
UK USA
us Technology & digital loss

What to do if…
cloud files are being moved to trash or deleted without your permission

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

If files are disappearing now, pause syncing or disconnect the device where the changes are appearing from the internet. Use another device you trust to secure the account, check the cloud service’s deleted-files area, and restore the most important files.

Do not do these things

  • Do not empty the Trash, Recycle Bin, Deleted Files, or Recently Deleted area.
  • Do not permanently delete unfamiliar files or duplicates while you are checking what happened.
  • Do not keep an apparently affected device online if deletions are continuing.
  • Do not use links in unexpected security messages; open the provider’s official website or app yourself.
  • Do not share your password, recovery code, or multifactor authentication code.
  • Do not erase, reset, or reinstall an affected device before recording the basic details.
  • Do not make large changes to shared folders while files are being restored.
  • Do not assume that deliberate account access is the only possible cause.

What to do now

  1. If deletions are continuing, pause the cloud-sync application on the device where they are appearing. If you cannot do that safely, disconnect that device from Wi-Fi, Ethernet, or cellular data.

  2. On a different device you trust, open the cloud provider’s official website or app directly. Check that you are signed in to the correct account.

  3. Open the service’s Trash, Recycle Bin, Deleted Files, or Recently Deleted area. Restore a few critical files first, then confirm that they remain restored before recovering larger groups.

  4. Check the service’s recent file activity, version history, sharing details, and shared-folder membership where those features are available. Note which files changed, when the changes occurred, and which account or device is shown.

  5. Change the cloud-account password to a new password that you do not use elsewhere. Review recovery email addresses, recovery phone numbers, signed-in devices, connected applications, and third-party access, and remove anything you do not recognize.

  6. Turn on multifactor authentication if it is available. Sign out other sessions or devices using the provider’s security settings where that option is offered.

  7. Secure the email account used to recover the cloud account if it may also have been accessed. Change its password, review its signed-in devices and recovery details, and turn on multifactor authentication.

  8. Save screenshots or notes of deletion times, affected filenames, unfamiliar devices, security alerts, sharing changes, and account activity. Do not include passwords or authentication codes in those records.

  9. For a work, school, or organization-managed account, contact the administrator or IT team promptly. Tell them that files are being deleted without permission, when you first noticed it, and whether the activity is continuing.

  10. If files are absent from the deleted-files area, restoration fails, or many files are affected, use the provider’s official support route. Ask about deleted-file recovery, missing-file searches, version history, and any account-wide restoration feature available for your account.

  11. Before reconnecting a device that may have caused the changes, update its operating system and cloud-sync application and run a full scan using its current, reputable security software.

What can wait

You do not need to identify who caused the deletions, reorganize every restored file, buy recovery software, replace devices, confront a collaborator, or decide whether to make a formal report now. First stop further changes, secure access, record what happened, and recover files that are still available.

Important reassurance

Cloud services often keep deleted files temporarily, and some also provide activity records or version history. Recovery options vary by provider, account type, sharing arrangement, and organization policy, so missing files are not necessarily permanently lost.

Scope note

This guide covers immediate account-security and file-recovery steps only. Further device investigation, organizational incident response, specialist cybersecurity support, or data recovery may be needed later.

Important note

This is general information, not legal, cybersecurity, data-recovery, or other professional advice. Follow the instructions provided by your cloud provider or organization administrator for the specific account.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us