Deleting a file from Microsoft OneDrive seldom removes it instantly or completely. In digital forensics, file deletion is viewed not as a total destruction of data, but as a series of state changes across multiple systems. When a user clicks delete, traces are generated on the local computer, in the local file system structure, within sync engine databases, and inside Microsoft 365 cloud servers.
For legal teams, corporate investigators, and private clients dealing with data exfiltration, breach of restrictive covenants, or disputed disclosure under the Civil Procedure Rules, understanding what evidence remains after a deletion is critical. A robust cloud forensics investigation can establish not only whether a file existed, but who deleted it, when the deletion occurred, from which device, and whether copies exist elsewhere.
Direct Answer: What Evidence Remains After OneDrive File Deletes?
When a file is deleted from OneDrive, forensic practitioners examine two primary domains: local endpoints (laptops, desktops, and mobile devices) and cloud infrastructure (Microsoft 365 tenancy logs and storage containers). Even if a user attempts to wipe their activity, multiple independent artifacts record the deletion sequence.
The primary digital artifacts left behind include:
- Microsoft Purview Unified Audit Log (UAL) records: Cloud-side immutable log entries detailing the exact user account, timestamp, IP address, and action (such as FileDeleted or FileRecycled).
- OneDrive Sync Engine Databases: Local SQLite databases on the endpoint, such as SyncEngine.db or SafeDelete metadata, which record sync states and file paths.
- Local File System Metadata: Master File Table ($MFT) entries, $LogFile, and $UsnJrnl on Windows machines, which record when a file was moved or unlinked.
- Volume Shadow Copies and Unallocated Space: Previous snapshots of the local hard drive that retain complete versions of the deleted file.
- Cloud Recycle Bins: Two-tier cloud storage recovery zones (First-Stage and Second-Stage/Preservation Hold Library) that retain files for specified retention periods.
Local Endpoint Artifacts: Tracing OneDrive Deletions on the Computer
Most users access OneDrive via the desktop synchronization client installed on Windows or macOS. The desktop client maintains a local directory structure that mirrors the cloud environment. When a file is deleted locally or remotely, the local operating system and the OneDrive sync engine leave forensic footprints.
1. The OneDrive Sync Database
The OneDrive desktop client relies on database structures to track file states, synchronization status, and server communication. On modern Windows installations, these databases are located within the user profile under local app data paths. Forensic tools parse these databases to reconstruct historical sync activities.
Key database entries disclose original file paths, unique file identifiers (Resource ID), file sizes, modification timestamps, and flags indicating whether a file was marked for local or cloud deletion. Even if the local folder appears empty, historical records in these database files frequently persist.
2. Master File Table ($MFT) and USN Journal
On NTFS-formatted Windows endpoints, file activity is recorded at the disk level. The Master File Table ($MFT) maintains a record for every file and folder. When a file in a OneDrive folder is deleted, its $MFT record is marked as inactive, but the metadata remains until overwritten by new data.
Furthermore, the Change Journal ($UsnJrnl) logs changes to files and directories. It records entries such as FILE_DELETE or CLOSE, associated with precise timestamp markers. Examining these journal entries allows a digital forensics practitioner using expert digital forensics services to verify whether a deletion was executed manually by a user or automatically by a synchronization process.
3. Shellbags and Recent File Artifacts
Windows maintains registry keys known as Shellbags to preserve user view preferences for folders. Shellbags confirm that a specific user navigated to a directory, viewed its contents, and interacted with specific folders, proving knowledge and interaction even after the contents have been removed.
Cloud-Side Evidence: Microsoft 365 and Purview Audit Logs
Local endpoint analysis provides context regarding user interaction, but cloud-side artifacts provide definitive, server-verified records. In corporate environments using OneDrive for Business or SharePoint Online, central logging mechanism captures administrative and user actions.
The Two-Stage Cloud Recycle Bin
When a file is deleted in OneDrive for Business, it is transferred to the user's First-Stage Recycle Bin. It remains here for a default period (typically 93 days in enterprise environments) unless manually cleared. If a user manually clears the First-Stage Recycle Bin, the file moves to the Second-Stage Recycle Bin (also managed via the site collection administration).
If retention policies or legal holds are active within the Microsoft 365 tenant, files are diverted to the Preservation Hold Library. In these circumstances, an end user cannot permanently destroy a file, regardless of their actions on the local computer or web interface.
Unified Audit Log (UAL) Analysis
The Unified Audit Log in Microsoft Purview is one of the most vital evidence sources in cloud investigations. When enabled, the UAL records detailed telemetry for actions across the tenant. Key events related to OneDrive file deletions include:
- FileDeleted: Generated when a user moves a file to the Recycle Bin.
- FileDeletedFirstStage: Logs the manual purging of an item from the primary Recycle Bin.
- FileDeletedSecondStage: Records the removal of an item from the secondary administration Recycle Bin.
- FileRecycled: Records when a file is sent to the system retention area.
Each event entry contains critical forensic fields, including the User ID, Client IP address, Workload (OneDrive), UserAgent (identifying browser or desktop client), and target file URL. Reviewing our digital forensic evidence guide offers broader context on how such cloud logs are preserved for formal court proceedings.
Mobile Devices and Synchronised Endpoints
Modern professionals frequently access OneDrive across multiple devices, including mobile phones and secondary laptops. Deleting a file on one endpoint triggers synchronization commands across all connected endpoints.
When a deletion command originates from a mobile application, local cached data, SQLite databases, and application logs on the mobile device can be examined. Specialized mobile phone forensics techniques can extract artifact databases that show when the OneDrive application was launched, which file previews were downloaded to local cache memory, and when network calls were issued to delete specific items.
Comparison of OneDrive Deletion Artifact Locations
The following table illustrates where digital evidence persists following a OneDrive file deletion, what information is retained, and how it is extracted.
| Evidence Source | Location Type | Key Information Retained | Evidentiary Purpose |
|---|---|---|---|
| Unified Audit Log (UAL) | Cloud Server | IP address, user account, exact timestamp, file URL | Proves identity, timestamp, and account action |
| Preservation Hold Library | Cloud Server | Complete, unaltered original file contents | Restores destroyed data for legal disclosure |
| Sync Engine Database | Local Endpoint | Local paths, sync state, file metadata, status flags | Demonstrates local client sync behavior |
| NTFS $UsnJrnl / $MFT | Local Endpoint | File deletion event logs, local cluster pointers | Confirms local file system activity timeline |
| Volume Shadow Copies | Local Endpoint | Historical file copies, previous folder states | Recovers complete file content prior to deletion |
Practical Challenges and Evidence Volatility
While substantial evidence can be recovered, digital evidence is inherently volatile. Timely action is essential to prevent critical evidence from being overwritten or automatically purged.
Key risks include:
- Audit Log Overwriting: Default Microsoft 365 audit log retention ranges from 180 days to 1 year depending on license tiers (such as E3 vs E5). If logs are not preserved quickly, server logs may expire permanently.
- Local Endpoint Overwriting: As an endpoint continues to be used, new data writes over unallocated disk space, permanently destroying unlinked files and old Volume Shadow Copies.
- Sync Propagation: If a local machine remains connected to the network, deletion commands propagate rapidly. Isolating devices immediately preserves the state of local databases.
In legal proceedings governed by the Civil Procedure Rules (CPR Part 35) or Criminal Procedure Rules (Part 19), digital evidence must be handled in strict accordance with ISO 17025 standards and NPCC principles. Independent forensically sound imaging ensures that chain of custody is preserved and evidence remains admissible in court.
What This Means for Your Case: Recommended Next Steps
If you suspect that relevant OneDrive files have been deleted, altered, or exfiltrated, immediate action is required to secure the digital environment before automatic retention periods expire or data is overwritten.
- Isolate Endpoints Immediately: Disconnect suspect computers and mobile devices from Wi-Fi and ethernet networks to prevent cloud synchronization commands from altering local disk states. Do not shut down or reboot machines ungracefully if memory state needs preservation.
- Issue Preservation Orders: Instruct Microsoft 365 tenant administrators to apply immediate Litigation Holds or In-Place Holds on affected user accounts and export the Unified Audit Logs without delay.
- Engage Certified Specialists: Instruct a accredited forensic laboratory to acquire forensically sound disk images of endpoints and secure cloud audit exports.
To discuss a potential instruction or request assistance with cloud evidence preservation, submit a request through our secure inquiry form to consult with our digital forensics team.