Finding data in Drive and Vault can be challenging. Here are some helpful search tips you can use in Vault, Google Drive, and various areas of the Admin console.
One of the most troublesome aspects of having a shared Google Drive structure is when users with Edit access move files or entire folders. This is often done to reduce clutter in their Drive, but they clean up a folder shared with them. Users are usually unaware that, based on how the sharing was applied, they may be removing access for all users other than the file's owner. Furthermore, the file's owner may not be able to locate the deleted (actually misplaced) file.
Understanding why this happens
When a user attempts to delete unwanted files from a Shared folder, they may encounter issues due to inherited share permissions. These permissions are passed down from the parent folder, and when a file or folder is moved, these inherited permissions are removed. Only the file owner has the authority to delete the file, while editors can move files between locations.
Locating the missing file
If you are the owner of the file, you can perform the following search in the Drive interface:
owner:me is:unorganized
When viewing the auto-completed results, you may see some of the individual files that have become unorganized, but you might not see all the results. Pressing Enter will bring up the complete search results.
What if you aren’t the owner?
If you are not the file owner, you can use the Reports section to locate a specific file and determine the owner and the user who performed the move.
- Go to Admin console > Reporting > Audit and investigation > Drive log events.
- In the draft investigation, add this filter: Event: IS: Move.
- Click the Manage columns cog, at the top right of the results list, to choose additional data about the returned events, including the Owner and Previous Visibility.
Prevent this from happening again
There are a few options to prevent users from moving files from within a shared folder structure.
- We recommend that users add a Drive Shortcut to a folder rather than moving it to a new location.
- The next option is to grant View access to the parent folder and Edit access to the files contained in the folder. With this setup, users will still see the folder structure, but when they try to remove a file from the structure, they will not be able to do so.
- Lastly, you can utilize Shared Drives. With Shared Drives, only users with Full access can delete or move files. When deleting files, users are explicitly informed that this action will delete the file for Everybody, ensuring they are fully aware of the consequences of their actions. Editors can still create, upload, or edit files, but they cannot move or delete a file.
| Document Version | Date | Description of Change |
| 1.0 | 6/27/2024 | revised and verified. |