Finding a deleted file...without knowing the owner

[David Walton]

I have a user who has a critical file (a department budget) that is a shortcut in their drive.

 Their shortcut is reporting that the file is deleted. He isn't able to identify any information from the shortcut about who actually owned the file, since the file has been deleted.

I suspect that someone in the department accidentally deleted the file while deleting Drive data due to Google storage changes, but all I have is a file name, and the file is likely in someone's trash somewhere.

Any idea where to start searching? Will queries like this one search the trash? 

[Alexander Grutza (Alex)]

Following. 

We have a similar situation right now. Unknown owner of a folder was possibly deleted (not purged, still 5 days to recover) and only have the folder name. Seeing how the possible account hasn't been purged yet, it seems like a dumb feature for Vault not to be able to search 'deleted but not purged yet' accounts. I'm aware a deleted account is not retained in Vault, but the account isn't truly deleted yet so IMHO the deleted accounts should still be searchable until they're purged. 

[Ross Scroggs]

Try the following:

gam report drive filter "doc_title==<DriveFileName>"

Ross

--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/9c4e5343-ee65-4ca9-bd59-b26017e8f799n%40googlegroups.com.

--

Ross Scroggs

ross.s...@gmail.com

[David Walton]

Thanks, Ross! That was easy and fast.

In this situation I knew the exact title. Is there a query for "name_contains" or something similar? Can you share documentation for the various syntax options?

[Ross Scroggs]

David,

Start here: https://developers.google.com/admin-sdk/reports/reference/rest/v1/activities/list

Scroll down to filters

Follow ApplicationName link

For a particular ApplicationName, follow events link.

Ross

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/5e6a1b39-1a34-4e5b-92dd-cbc8db3ecfabn%40googlegroups.com.

--

Ross Scroggs

ross.s...@gmail.com

[James SEYMOUR]

Hi David,

While you review the syntax options, I have this command recorded that should work ...

gam all users print filelist query "name contains '\"<Part of File Name>\"'" 

The all users could be changed to search a small number of users if needed, such as an OU, group or a single user.

Cheers

James