Track and see who and when a Google Drive file was deleted
GAT+ is an Audit tool for your Google Workspace environment. It allows Admin to see everything that is happening on the domain.
In one of the sections in the Drive audit, an Admin can view all the Events for the files and folders.
For example, an Admin can track and see who and when a file was deleted. Here’s How:
Open GAT+ and click on Drive audit.
From the top menu select the Events tab
This will show you all the “Events” that are happening to your Drive files.
Apply custom filter and search for Event equal Delete
The result will show all the Deleted Files.
The Email tab will show Who deleted the file.
The Email will show the person who deleted the File.
- File owner will be the same email as Files can be ONLY deleted by Owner.
- When the owner is Shared Drive (name with green background), the Email tab will show the person who deleted the File
- Shared Drive – only Managers and Content managers can delete files
Additional filters can be applied for specific Files/Shared Drives you want to see who deleted them.
Search for Shared Drive ID and filter on Delete events, to view all files that are deleted and who deleted them from the Shared Drive.
An Admin can combine the filters and search for Events equal to Delete or Trash – to see all Deleted and Trashed files and who did the Deletion.
To request a demo please click here and fill the form, We’ll get back to you in less than 12 hours during weekdays.
If you trailed GAT in the past and would like to run a fresh trial again, please enquire through this form.