Google deleting files again

[synaesthesia]

Hi all,

 

Last year, there was an issue with Google deleting files at will, apparently relating to a bug with the cache in the Appdata folder.

We seem to be stumbling across this issue yet again, certainly at our school and possibly others. Files suddenly being moved to the users' Trash folder, audit logs showing they deleted them (they didn't).

No deletion of profiles, possibly some changes made, but Google support have confirmed there is likely to be an issue which they are looking into.

 

Is anyone else seeing this? Once or twice you may think people are accidentally deleting things, but this is definitely not the case

It may be worth checking your tenants anyway, just to be sure!

[IKWeb]

Have you logged this with Google Support? What have they said?

[synaesthesia]

They've confirmed an issue and are investigating. In the meantime we're sat here trying to restore tens of thousands of files at Google's wonderful limit of a couple hundred at a time which noone has time for

I don't understand how anyone can say this is a complete, usable product. I know MS isn't perfect but this sort of thing is just *easy*

[IKWeb]

Sadly it's not easy - or lots of us would be creating our own client software to sync to our favourite cloud providers. so saying its easy - isn't true. but I get ur frustration.

 

If you are doing this from a user's device - yes it will take you a long time.

 

Do it from the Google Admin Console - a lot easier.

 

https://support.google.com/a/answer/6052340?hl=en#:~:text=Restore%20Drive%20data&text=Sign%20in%20using%20your%20administrator,in%20%40gmail.com).&text=Users.,needs%20their%20Drive%20data%20restored.&text=Restore%20data.

 

Or you can write ur own script and do it via GAM if you have a few users who are affected.

 

Both ways - a lot better than doing it from the users end.

[synaesthesia]

That article is only for recovering files that have been deleted from trash, not files which are currently sitting in trash.

And yes, it was easy when you've come from an MS tenant where doing things like this on a per tenant, per domain, per group or per user context is a couple of clicks at most without any scripting.

I've not been able to find any documentation for achieving the restoration of trashed files via GAM, if there's anything you're aware of it'd be really useful!

[IKWeb]

If the files are sitting in Trash - just empty the trash and then do the recovery - if it's faster than sitting at the device doing 100 or so at a time?

[synaesthesia]

That has crossed my mind, but not as much as skids would cross my pants doing it

 

Edit: Works well on a test user, just wondering why neither of the Google folks suggested it.

Still too nervous to try it on live data

Edited April 22, 2024 by synaesthesia

[synaesthesia]

Still ongoing. Google support is being absolutely diabolical - chased for answers every day last week then finally got a "we'll get you an answer 24-48 hours from now" on Friday. Still nothing as of this morning. 15k files deleted over the weekend. Manual restoration is all I've done for the last week, and we're absolutely sick of it. Clearly something we've done has kicked this problem off, but the fact we're streaming rather than syncing proves without doubt there's a problem with the soft. SLT rightly fuming (and have my back thankfully) and all at wits end Literally going back to encrypted USB storage for some, just to tide us over!

Absolute joke

[PotNoodleTech]

Ultra strange - usually whenever a user says my files are gone and they didn't delete them it ends up that they did delete them.

 

These files are they shared with a lot of people?

 

Mind you the way you've lost 15,000 files I would be looking at are there any automated systems you have linked in that could be doing it or extensions or software that that user has access too? I read some of the permissions summaries on the play store for many apps and I shake my head in disbelief.

[synaesthesia]

Yeah, that would have been the first thing that came to mind, until it's lots of users at up to 15k files *each*. At a rough estimate we're up to around 120k in total and the only app involved is the Google Drive app for windows, so staff can make full use of a capable Office suite without resorting to the online shenanigans. Google themselves have confirmed an issue but radio silence for any concrete cause or resolution.

 

The only thing that seems to kick this off are small changes to user profiles - enabling offline files specifically. A scenario that is neither rare or likely to kick off such a problem especially in streaming mode. And this is just user's own My Drive, not shared files.

[IKWeb]

Yeah, that would have been the first thing that came to mind, until it's lots of users at up to 15k files *each*. At a rough estimate we're up to around 120k in total and the only app involved is the Google Drive app for windows, so staff can make full use of a capable Office suite without resorting to the online shenanigans. Google themselves have confirmed an issue but radio silence for any concrete cause or resolution.

 

The only thing that seems to kick this off are small changes to user profiles - enabling offline files specifically. A scenario that is neither rare or likely to kick off such a problem especially in streaming mode. And this is just user's own My Drive, not shared files.

 

 

Keep in mind - if this was a Google issue - I would think we would see a lot of users on the Google EDU forums etc jumping up and down and going nuts - just make sure you have checked everything ur end while you are waiting on Google.

[Michael]

What's strange is I haven't had this issue at any of my schools. Presumably it's files from a Shared drive, but then Google's good at identifying the user who either moved or deleted said folder.

[synaesthesia]

It's my drives not shared. And yes, that was obviously the first thing that came to mind, however it's also possible that the problem like last time is getting hugely covered up. Google jumped on the November issue like mad which is why there's so little out there even from the media outlets that covered, compared when it actually hit.

But still, applying some logic, Google stream = only cached files stored, what behaviour should cause this? None.

[Michael]

How do you mean only cached files stored?

[synaesthesia]

Stream mode only stores cached files for frequent use, it doesn't store anything else nor does it (or nor should it) mirror files, hence this shouldn't have an impact.

[IKWeb]

It's my drives not shared. And yes, that was obviously the first thing that came to mind, however it's also possible that the problem like last time is getting hugely covered up. Google jumped on the November issue like mad which is why there's so little out there even from the media outlets that covered, compared when it actually hit.

But still, applying some logic, Google stream = only cached files stored, what behaviour should cause this? None.

 

Lots of things could cause this - for example, The user has given access to a rogue plugin/website that they have granted full access to the user's "My Drive" and this is deleting files. another could be malware, virus etc. I am not saying Google isn't at fault - but if it were a more widespread issue people would be posting this issue on the forums. But I haven't seen anyone saying they are having a problem.

[synaesthesia]

I know, but as I've said, Google have confirmed the issue. Staff don't have the ability to install 3rd party software, plugins, extensions etc, and even if they could it's unlikely they'd all suddenly get the same dodgy one.

And of course causation/correlation - lots of people are having issues that may fit the bill, so it could be a wider issue but not many others have gone into it in as much detail. Lots of possibilities, and I'm chomping at the bit to see what Google come back with.

If it's me, I'll literally be handing in my resignation the moment I see evidence!

[synaesthesia]

This is the nearest I have to an "answer" which is provided by myself - a reference to file mirroring occurring even though it's in streaming mode. It could be just language being used rather than actually mirroring files, but in this case it's exactly 525 files that went walkabouts this morning for that user.

[PotNoodleTech]

I think the issue is far too bizarre to be your fault mate.

[synaesthesia]

Bizarre is certainly a good description! I can only assume that a certain set of circumstances has triggered it, but without knowing what they are, we're powerless to correct or even pause it short of removing the drive app. The worst thing about it is Google's support (or lack of). Would anyone happen to have a handy escalation contact please?

[mrstrong]

Hi, did you get a resolution / answer from google ?

 

I was troubleshooting my personal google drive a while back and found lack of info quite frustrating.

Seems files are stored in user cache (appdata) but only really accessible via the virtual drive. I'm sure

you know all this and have probably captured drive logs for google support. Other thing I thought

was sysinternals procmon to check the process deleting files but I guess that will just confirm it's

the "google drive for desktop"

https://learn.microsoft.com/en-us/sysinternals/downloads/procmon

[synaesthesia]

Not as yet - their support has been diabolical to say the least, to the point where I'm actively considering moving to another school that isn't Google. The problem is one thing, their handling of it is just something else.

It's just baffling, as streaming mode shouldn't be doing any sort of deletion anyway, and although it's easy to predict which thousand or so files get deleted in each go, it's never all files. Plus I can create files both locally and "online" and both get deleted.