300GB of files deleted from my OneDrive. How can I find the exact path for how the deletion was initiated?

Understanding Unexpected Data Loss in OneDrive: How to Trace the Deletion Path

Introduction

Experiencing the sudden and unexplained deletion of large volumes of files can be distressing, especially when it involves critical data stored in cloud services like Microsoft OneDrive. If you find yourself in such a situation—discovering that approximately 300GB of files, spread across multiple folders, have been deleted without your initiation—you may naturally question the cause and seek answers. This article aims to guide you through the process of investigating such incidents, focusing on how to identify the origin and timing of deletions within the Windows environment.

Assessing the Situation

First, it’s important to clarify that if you are certain you did not delete the files, and no other individuals have access to your machine, the event could be a sign of an underlying issue—potentially security compromise or a system anomaly. Notably, the deletions occurred across various folders and at different times, rather than simultaneously, which suggests a non-standard process. Although rare, understanding how Windows and OneDrive log activities can help you pinpoint the cause.

Does Windows Keep a Log of File Operations?

Windows operating systems maintain various logs that record system and application events. Among these, the Event Viewer is a powerful tool that can provide insights into file system activities, user actions, and system errors. Although Windows does not log every individual file deletion by default in a straightforward manner, certain logs and audit policies can be configured to track such events.

How to Enable and Access Audit Logging

Enable Audit Logging for File Operations
Open the Local Security Policy editor by typing secpol.msc into the Start menu or Run dialog.
Navigate to Security Settings > Advanced Audit Policy Configuration > Object Access.
Enable Audit File System for success and failure events.
Ensure that the relevant folders or drives are configured for auditing.
Configure Folder-Level Auditing
Right-click the folder you wish to monitor.
Select Properties > Security > Advanced > Auditing > Add.
Choose the users or groups to audit, and specify the type of access (e.g., delete) to log.
Reviewing the Logs
After enabling auditing, delete actions will be logged in the Windows Event Viewer.
To view these, open Event Viewer (eventvwr.msc) and navigate to **Windows Logs >