Box Drive Accidental Deletion
Since the introduction of Box Drive end users that haven't read the documentation and skip through the walkthrough aren't used to seeing all of the files and folders.
The user without realizing, then believes that all of these files and folders either aren't needed or are taking up physical space on their hard drive. The user then either randomly deletes select files and folder or just deletes everything within Box Drive. A solution is needed to either further alert or prevent this. One other possible solution is to create a process to fully restore all of the deletions and collaborations.
When this happens, it literally deletes all of the files and folders from Box. For the user that made the deletion, it will also remove them as a collaborator from those files and folders the user didn't own.
This causes a number of issues and use cases:
- The user realizes the mistake, stops the deletion and restores all of the data from the Trash via the Box UI. -Since the user was removed as a Collaborator, it is physically impossible to restore the shared folders and files because those physically sit in the Owner's Trash. The Owner or an Admin has to manually restore the data. -Depending on the timing if the restore is done versus the deletion, the user may or may not still be a collaborator on the Parent/Child folders, thus causing Orphaned Folders and Files during the restore. In this case, all of the Orphaned Files and Folders will be restored to the user that is restoring the data without any of the previous Collaborators
2. The user creates a ticket with the Admin and the Admin manually restores the data; however, this can still have all of the same issues as #1 unless the data is all restored without breaking the Parent/Child relationships
Current Admin recommended steps for resolution:
1. Run the Collaboration Report EVERY day
2. As soon as the issue is reported, run the User Activity Report for the user for the last 30 days (this will help when checking the unique ID's of deleted versus restored in Step #10), specifically selecting the "Moved to trash" (under File Management) and "Removed collaborator" (under collaboration)
3. Filter through the report to see what folders the user has been removed from as well as how many items were deleted and from where (specifically looking for the parent folders to not cause orphaning when restoring)
4. Based on that list, take the Collaboration report from #1 and filter it based off of the user that made the deletions email in column I named Collaborator Login. This provides the list of folders and folder Owners that once the data is restored could still possibly have data in their trash
5. Login to the user's account or have the user that deleted the data, change the Files and Folders Per Page to 100 in Account Settings
6. Go to the Trash and select the "Items I Deleted Drop" down and either select the items to restore or select "Restore All" (this could restore files that truly should be deleted)
7. If there were no errors restoring, then run the Activity report again with the same settings from step #2 and also include "Restored from trash" (Under File Management), if there were errors skip to Step #11 otherwise go to step #8
8. Filter the report for "Trash" and take all of the Unique ID's for the "Affected ID" Column G and de-dupe that in a new sheet
9. Filter the report for "Undelete" and take all of the Unique ID's for the "Affected ID" Column G and de-dupe that in another new sheet
10. Compare those ID's, if they data sets are the same then all data has been restored. Please note that if a "Restore all" was done on the trash this could include data deleted before that date and may have restore id since the reports include 30 days
11. If the data sets don't match, then take the Collaboration report from #4 and as an Admin, log into each individual account and restore the deleted file from the Trash just like in #6 or reach out to the user's and have them do this (if files were orphaned, please check the root level for the user that restored the data)
12. To be 100%, the same activity report from #7 will need to be ran for every user that data was restored from but in this case only for the respective day and then compare the same way as step #10 with the existing ID's gathered in step #10
13. Finally, if still this doesn't line up log back into the account that deleted the data and check the root level for the possibly Orphaned files/folders
This is the only way to be certain 100% everything has been restored