Drive audit logs to check missing data

Problem

Missing data in Google Drive and an administrator wants to know who deleted the missing data.

Environment

  • Google Drive 
  • Drive audit logs 

Solution

  1. Review the Google Drive audit logs on the left, click Reporting > Audit and investigation > Drive log events.
  2. Click Add a filter, and then select an attribute.
  3. In the pop-up window, select an operator > select a value > click Apply.
  4. (Optional) To create multiple filters for your search:
    1. Click Add a filter and repeat step 3.
    2. (Optional) To add a search operator, above Add a filter, select AND or OR.
  5. Click Search.

Cause

User deleted some data in Google Drive.