User removed an item from ...

[Ben Warner]

We have an issue where a user deleted all his locally synced My Drive files.  I found that he was syncing our entire Org's file structure.  This removed all permissions from all the files and folders he was syncing and made them all private. He was not the owner of these files.

I believe I have a handle on how to restore the access changes he made, but does anyone know how to restore the file/folder locations?  When I run a report using the admin console, I don't get the parent folder IDs, just the name.  Does anyone know how to run an audit report to find all files/folders where "User event: Remove from Folder" and include the parent folder IDs?

Thanks,

[+KimNilsson]

If he wasn't the owner, then I don't see how he would be able to remove the owner's privileges?

That would also not allow that user to permanently delete anything. The real owners should be able to restore the material to their original locations.

Or did each individual file lose their connection to the previous location when the folder too was deleted?

I mean, if you do a single manual file restoration by the rightful owner, will that file only end up in the root of said file owner's Drive?

[Ryan Castle]

Yes. There is now an option for this. The Google Apps Admin SDK has a Reports API, which provides similar information to the Google Drive Audit Log, but it includes more metadata. In particular it includes the "parent folder ID".

https://developers.google.com/admin-sdk/reports/v1/guides/manage-audit-drive