A user reports a project folder is gone. Your first question is not "can we get it back?" but "who deleted it, and when?" The answer is usually somewhere in SharePoint - in the Recycle Bin if the deletion is recent, or in the Microsoft Purview audit log if more time has passed or the bin has been cleared.
This guide covers all four methods in order of effort, from the quickest check (Recycle Bin) to the most thorough investigation (audit log export).
Step 1: Check the First-Stage Recycle Bin
The Recycle Bin is your first stop. It shows a Deleted By column alongside the item name, original location, and deletion timestamp. As long as the item is still in the bin (within the 93-day window and not yet manually emptied by a site owner), you can identify who performed the deletion in seconds.
- Navigate to the SharePoint site where the content was deleted.
- Click the cog icon and choose Site contents, then click Recycle Bin in the left navigation. Alternatively, append
/_layouts/15/RecycleBin.aspxto the site URL to go there directly. - Locate the missing file or folder. The Deleted By column shows the user account that performed the deletion, and the Time Deleted column shows exactly when.
- Click the item name to see its full original path under Original Location.
For investigations spanning many sites (for example, a suspected malicious deletion or a migration incident), checking each site's Recycle Bin individually does not scale. ShareMaster's Recycle Master indexes bins across all connected sites and supports search by deleted-by user, item name, original path, and date range from a single interface.
Step 2: Check the Second-Stage (Site Collection) Recycle Bin
If a site owner has already emptied the first-stage bin, or if the item was deleted by a site-level automated process, the file moves to the second-stage Recycle Bin. Only site collection administrators can see this stage.
Navigate there directly using this URL pattern:
/sites/<your-site>/_layouts/15/AdminRecycleBin.aspx
The second-stage bin shows the same Deleted By column as the first stage. SharePoint preserves the original deletion timestamp: the date shown is when the item was first deleted, not when it was moved from stage one to stage two.
If you find the item here and want to restore it, see the bulk restore guide if multiple items need to come back at once. Note that if the original location (folder or library) has since been deleted, SharePoint will restore the item to the first-stage bin rather than its original path.
See how Recycle Master searches deletions across all your sitesStep 3: Search the Microsoft Purview Unified Audit Log
Once an item has been permanently deleted (second-stage bin emptied, or 93 days have expired), the Recycle Bin no longer holds it. The Microsoft Purview audit log is now the only source for the Deleted By information.
- Sign in to the Microsoft Purview compliance portal at
compliance.microsoft.comusing a global administrator or compliance administrator account. - In the left navigation, go to Audit and click New search.
- Set the Start date and End date to cover the suspected deletion window. Purview requires a specific date range.
- Under Activities - friendly names, filter to Deleted file (found under SharePoint file and folder activities).
- Under Site URL, enter the URL of the relevant SharePoint site to narrow results. Leave it blank to search the entire tenant.
- Click Search and wait. On large tenants, searches may take several minutes to complete.
- Each result shows the User (the account that deleted), Date, Item (file name), and Site. Click any row to see the full event detail including the file's original URL path.
The audit log entry URL path is especially useful when a user says "a whole folder disappeared": search for all deletions matching a folder path within a given time window to see every file that was removed and by whom.
Step 4: Export the Audit Log for Multi-Site or Legal Review
For incidents spanning multiple sites, or when you need to pass the deletion record to legal, HR, or compliance teams, an Excel export is the most practical format.
From the Purview audit search results, click Export. This downloads a CSV with the raw event data: user, timestamp, site, file name, operation type, and the full JSON event payload. See how to export the SharePoint audit log to Excel for the full process.
Audit Log Retention by Microsoft 365 Plan
| Microsoft 365 plan | Default deletion event retention | Extended option |
|---|---|---|
| Business Basic, Business Standard, Business Premium | 90 days | Not available |
| E3 / A3 / G3 | 1 year | 10-year add-on available |
| E5 / A5 / G5 | 1 year | 10-year retention included with E5 Compliance |
If the deletion occurred outside your audit log retention window and the item is no longer in the Recycling Bin, the deletion record is not available through standard SharePoint tooling. Microsoft 365 Backup (if your tenant subscribes) may hold a snapshot of the content from before the deletion.
When the Audit Log Shows No Results
Two common causes:
- Audit logging was not active at the time of deletion. Microsoft 365 audit logging is on by default for most current plans, but tenants migrated from older configurations may have gaps. The Purview audit page shows the date from which auditing has been active for your tenant. If auditing was off when the deletion occurred, there is no event to retrieve.
- The deletion was performed by a service account or application. Deletions via Microsoft Graph API or SharePoint REST API are attributed to the service principal or app identity, not a named user. The event still appears in the audit log, but the "user" field shows an application display name rather than a person's name. Filter by the date range and file path to find these events.
Frequently Asked Questions
How long does SharePoint keep a record of who deleted a file?
The Recycle Bin shows the Deleted By field for items still in the bin (up to 93 days from deletion). The Microsoft Purview audit log retains file deletion events for 90 days on Microsoft 365 Business plans, 1 year on E3, and up to 10 years on E5 or with the optional audit log retention add-on.
Can a site owner see who deleted files in SharePoint?
Yes. A site owner can open the first-stage Recycle Bin and see the Deleted By column for any item still in the bin. To see items that have been emptied from the first stage, the owner must also be a site collection administrator, which grants access to the second-stage bin. For items beyond the 93-day window, the owner needs access to the Microsoft Purview audit log.
What if the SharePoint audit log shows no deletion results?
Audit logging must have been enabled at the time of the deletion for events to be recorded. If it was not enabled, there is no record of the event in Purview. The Recycle Bin is still the fallback source if the item is within its 93-day retention window.