Blog / Playbooks
Match what you see to a timed runbook. Freeze first. Restore to a side path. Do not rebuild a same-name folder while the original might still be recoverable.
| If you see this | Severity | Owner | Open |
|---|---|---|---|
| Folder looks empty on the PC, but you have not confirmed the web app | P3 | Helpdesk | Deleted files or a sync conflict? |
| The file is still there, but the contents are wrong or overwritten | P2 | Helpdesk / site owner | Restore from version history |
| Many files or mail items disappeared at once | P1 | Tenant admin | First 60 minutes after a mass delete |
| Files renaming, encrypting, or spreading through the sync client | P1 | IT + identity | First 4 hours of OneDrive or Drive ransomware |
| An entire site, library, or Shared Drive is gone — not one folder | P1 | SharePoint / Workspace admin | SharePoint site or Shared Drive vanished |
| Google Drive items are in Trash or just left Trash; Takeout will not help in time | P2 | Drive manager / admin | Google Drive files deleted (without Takeout) |
| HR or helpdesk deleted the account and someone still needs the mail | P2 | M365 / Workspace admin | Mailbox after a user was deleted |
| Trash, Recycle Bin, and deleted-user restore are already empty | P1 | IT + legal | Native recovery windows have expired |
| You are not in an incident — you need to prove restore still works | P3 | IT operations | 90-minute restore drill |
These are operational checklists, not vendor marketing. Teach the native recycle/version tools first; independent copies are the fallback when those windows close.