ACSC Logo
© GEMXIT
GEMXIT Logo
Agent Foskett Investigation • SharePoint Online • Microsoft 365 Audit • Microsoft Sentinel • OfficeActivity • KQL

The SharePoint File Was Deleted — But the Audit Trail Still Had the Evidence

The file was gone.

It was no longer sitting in the SharePoint library where the team expected it.
The user said they had not deleted it.
Nobody could explain what happened.

Looking at the library alone was not going to solve the case.

Agent Foskett opened the audit trail.

The file had disappeared. The evidence had not.

Discuss Microsoft security Back to investigations
Agent Foskett investigating a deleted SharePoint file through Microsoft 365 audit evidence
Deleted Does Not Mean Invisible

SharePoint content can disappear from the user's view while audit telemetry still records the operations, identity, source IP and timing around the event.

✓ Reconstruct the file history
✓ Identify the deletion event
✓ Scope the user and source IP

The file itself could no longer answer the question

The investigation began after a business-critical spreadsheet disappeared from a SharePoint library. Searching the current library showed what existed now. The audit trail was needed to explain what had happened before the file vanished.
File missingThe expected document was no longer visible in its normal SharePoint location.
User disputed the deletionThe account owner did not recognise removing the document.
Historical evidence requiredThe investigation needed activity records rather than the current library state.

Reconstruct the complete file history

Where Microsoft 365 audit data is being collected into Microsoft Sentinel, OfficeActivity can provide SharePoint operations for hunting. Start with the filename and preserve the operation, user, source IP, site and path so the file's activity can be read as a timeline.
sharepoint-file-history.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
  15. 15
let File = "Finance-Forecast.xlsx";
OfficeActivity
| where TimeGenerated > ago(30d)
| where OfficeWorkload =~ "SharePoint"
| where SourceFileName =~ File
| project TimeGenerated,
          Operation,
          UserId,
          ClientIP,
          Site_Url,
          SourceRelativeUrl,
          SourceFileName
| order by TimeGenerated asc

Find the deletion event

Now narrow the file history to deletion-related operations. The objective is to identify the timestamp and account associated with the recorded deletion before making assumptions about intent.
sharepoint-delete-event.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
  15. 15
  16. 16
let File = "Finance-Forecast.xlsx";
OfficeActivity
| where TimeGenerated > ago(30d)
| where OfficeWorkload =~ "SharePoint"
| where SourceFileName =~ File
| where Operation has "Deleted"
| project TimeGenerated,
          Operation,
          UserId,
          ClientIP,
          Site_Url,
          SourceRelativeUrl,
          SourceFileName
| order by TimeGenerated asc

The audit trail gave the investigation an anchor point

Once the deletion timestamp was established, the incident could be reconstructed around it. The question changed from “Where did the file go?” to “What was this identity doing immediately before and after the deletion?”
14:17 — file activityThe account interacted with content in the same SharePoint site.
14:22 — deletion recordedThe audit trail associated the file deletion with an account and source IP.
14:24 — more activityAdditional SharePoint operations showed that the deletion was not an isolated event.

What was the user doing around the deletion?

Build a focused window around the deletion timestamp and review the same user's SharePoint operations. Nearby downloads, accesses, moves, changes or additional deletions can provide the behavioural context missing from a single audit record.
user-delete-window.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
  15. 15
  16. 16
let User = "alex@contoso.com";
let DeleteTime = datetime(2026-08-27 14:22:00);
OfficeActivity
| where TimeGenerated between
    ((DeleteTime - 30m) .. (DeleteTime + 30m))
| where OfficeWorkload =~ "SharePoint"
| where UserId =~ User
| project TimeGenerated,
          Operation,
          SourceFileName,
          SourceRelativeUrl,
          Site_Url,
          ClientIP
| order by TimeGenerated asc

What else came from the same IP?

The source IP is another useful pivot. Search SharePoint activity from that address and summarise the users, operations and sites involved. This can help determine whether the event was isolated to one account or part of wider activity.
sharepoint-source-ip.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
  15. 15
let SuspiciousIP = "203.0.113.25";
OfficeActivity
| where TimeGenerated > ago(7d)
| where OfficeWorkload =~ "SharePoint"
| where ClientIP == SuspiciousIP
| summarize Events=count(),
            Files=dcount(SourceFileName),
            FirstSeen=min(TimeGenerated),
            LastSeen=max(TimeGenerated)
    by UserId,
       Operation,
       Site_Url
| order by Events desc

Was the account behaving differently?

Summarising the user's SharePoint activity by hour, operation and IP can expose bursts of activity that are difficult to see in individual records. Compare the suspicious period with the user's normal pattern before deciding what the activity means.
user-sharepoint-pattern.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
let User = "alex@contoso.com";
OfficeActivity
| where TimeGenerated > ago(7d)
| where OfficeWorkload =~ "SharePoint"
| where UserId =~ User
| summarize Events=count(),
            Files=dcount(SourceFileName)
    by bin(TimeGenerated, 1h),
       Operation,
       ClientIP
| order by TimeGenerated asc

Is this happening elsewhere in SharePoint?

After understanding the individual file, widen the hunt. A daily view of deletion-related operations by site can identify unusual clusters and help determine whether the incident is one missing document or part of a larger pattern.
tenant-deletion-scope.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
let DeleteOps =
    OfficeActivity
    | where TimeGenerated > ago(30d)
    | where OfficeWorkload =~ "SharePoint"
    | where Operation has "Deleted";
DeleteOps
| summarize DeletedFiles=count(),
            UniqueFiles=dcount(SourceFileName),
            Users=dcount(UserId)
    by bin(TimeGenerated, 1d),
       Site_Url
| order by TimeGenerated asc

The audit record is evidence — not motive

An audit event can establish that an operation was recorded for an identity at a particular time. It does not automatically tell you why it happened or whether the person behind the account intended it. Identity, device, session and surrounding activity may still be required.
Operation evidenceShows the SharePoint action that was recorded.
Identity and sourceProvide pivots into the account and network context.
Surrounding behaviourHelps distinguish an isolated business action from suspicious activity.

What the evidence can and cannot prove

A SharePoint audit record can strongly support when an operation occurred and which identity was associated with it. It does not by itself prove that the named human personally performed the action, that the deletion was malicious or that the account was compromised.
ProvenA deletion-related SharePoint operation was recorded for the file.
CorrelatedUser, IP, site and nearby operations help reconstruct the activity around it.
Do not overclaimAn account in an audit record is not automatic proof of malicious intent by the account owner.

Agent Foskett's investigation mindset

Do not confuse the current state of a cloud service with its historical evidence. A file can be moved, renamed or deleted, but the investigation may still be recoverable from audit telemetry.
Find the historical eventUse the audit trail to establish the operation and timestamp.
Pivot from the eventFollow the user, IP, site and surrounding actions.
Build the wider storyDetermine whether the deletion was isolated or part of broader activity.

Investigation findings

The SharePoint file was no longer present in its expected library location, but Microsoft 365 audit telemetry preserved the activity needed to investigate it. The audit trail identified a deletion-related operation, the associated account, source IP and timestamp. Surrounding SharePoint events then provided the context needed to scope the account and determine whether other files or sites were involved.
The file was goneThe current SharePoint library could not explain the historical event.
The audit trail remainedHistorical operations preserved the key investigative pivots.
The deletion became a timelineUser, IP and surrounding activity turned one missing file into an evidence-based investigation.

Related Agent Foskett investigations

Continue with SharePoint, Microsoft 365 and cloud audit investigations.
The SharePoint File Was Accessed 2,400 Times OvernightInvestigate unusual SharePoint access volume and determine whether the pattern is expected or suspicious. Agent Foskett InvestigationsContinue through practical Microsoft security investigations built around evidence and timelines. Agent Foskett AcademyBuild practical Microsoft security investigation and KQL skills.
The file was deleted. The evidence wasn't.
When cloud content disappears, reconstruct the history from the audit trail.
Continue the Investigation

Final thought

A missing file can make an investigation feel as though the evidence disappeared with it. In Microsoft 365, that is often the wrong place to stop. Audit telemetry can preserve the operation, identity, source and timing needed to reconstruct what happened. The file may no longer be where you expected it. The story can still be sitting in the logs.
When was it deleted?Find the recorded operation and establish the anchor point.
Who and where?Use the account and source IP as investigative pivots.
What happened around it?Build the surrounding SharePoint activity into a complete timeline.
Develop IT. Protect IT.
GEMXIT PTY LTD | GEMXIT UK LTD
Talk to GEMXIT
ACSC Logo

GEMXIT PTY LTD  |  GEMXIT UK LTD  |  © GEMXIT

The SharePoint File Was Deleted — But the Audit Trail Still Had the Evidence

This Agent Foskett investigation explores SharePoint Online audit evidence, Microsoft 365 activity, Microsoft Sentinel OfficeActivity and KQL.

SharePoint File Deletion Investigation

The investigation reconstructs a deleted SharePoint file using historical audit operations, user identity, source IP address, site activity and surrounding events.

Microsoft 365 Audit, OfficeActivity And KQL

Deleted cloud content can still leave valuable historical telemetry. Audit data helps defenders establish when an operation occurred and provides pivots for wider identity and SharePoint investigation.