What to do if…
your “recently deleted” folder is emptied and you did not empty it
Short answer
Stop unnecessary use of the device/account, pause syncing if you can, and immediately check provider recovery routes (web recovery, recycle/trash, version history, backups) while you secure the account.
Do not do these things
- Don’t keep taking new photos, downloading large files, or running “cleanup/optimiser” tools on the same device while you’re trying to recover data.
- Don’t click “support” links from emails/texts about this incident—go to the provider’s official support pages via their app or by typing the address yourself.
- Don’t sign out everywhere until you’ve first captured basic evidence (screenshots, timestamps, device/session list), because those screens can change.
- Don’t assume it was a “glitch”: treat it as sync settings, shared access, or unauthorised access until ruled out.
What to do now
-
Freeze the situation (2 minutes).
If it’s safe and practical, put the device in Airplane Mode or turn off Wi-Fi/mobile data to pause syncing while you check the account from another trusted device or the provider’s web dashboard. -
Capture quick evidence before anything changes further.
Screenshot: the empty “recently deleted/trash” view, any “recent activity”/audit log your service shows, and the list of signed-in devices/sessions. Note the time you first noticed and which device you were using. -
Check every “second chance” location for your service (not just one folder).
Depending on what you use, look for:- A web recovery area (some providers let you recover recently deleted items from account settings on the web)
- The service’s Trash/Recycle Bin (cloud and/or local)
- Version history / “restore previous versions” for files and folders
- If you use work/school storage (e.g., SharePoint/OneDrive work): ask your admin/owner whether a second-stage recycle bin exists and can be restored from
-
Check whether another device or shared access did it.
In account/security settings, review “recent security events” and “devices/where you’re signed in”. Look for unknown devices, unfamiliar locations, or sign-ins at odd times. Also consider family/shared devices that are signed in. -
Secure the account without locking yourself out.
- Confirm recovery email/phone are still yours.
- Change the account password (and any other accounts that reused it).
- Turn on 2-step verification / 2FA.
- Remove unknown devices/sessions and revoke access for unfamiliar third-party apps.
-
Contact the provider’s support quickly and plainly.
Use the provider’s official recovery/support path and say: “My ‘recently deleted’ was emptied without my action. Is any server-side recovery possible, and do you see signs of unauthorised access?” Share timestamps and screenshots. -
If you suspect fraud/cyber crime (phishing, extortion, account takeover), report it via the right route.
- England/Wales/Northern Ireland: use Report Fraud (the police reporting service for fraud and cyber crime).
- Scotland: report to Police Scotland on 101 (non-emergency), unless it’s an emergency.
What can wait
- You don’t need to decide today whether to replace hardware, switch platforms, or pay for new storage.
- You don’t need to confront anyone immediately (if you suspect shared access) until you’ve checked device/session logs and recovered what you can.
- You don’t need to factory reset a device as a first move unless official support or a trusted security professional advises it.
Important reassurance
This feels alarming because deletion plus syncing can happen fast and silently, making it look like everything vanished at once. A short pause, preserving evidence, and checking recovery paths methodically gives you the best chance to recover and prevent further loss.
Scope note
These are first steps only—focused on preventing further loss, checking recovery options, and securing access. Deeper cleanup and long-term backup improvements can wait until things are stable.
Important note
This is general information, not legal advice and not a guarantee of recovery. Recovery options depend on the provider, your settings, and how much time has passed. If anyone pressures you to pay urgently for “recovery” or asks you to install remote-control software, treat that as a red flag and use only official provider support channels.
Additional Resources
- https://support.apple.com/en-gb/guide/icloud/mmae56ea1ca5/icloud
- https://support.apple.com/en-gb/guide/icloud/mm08b49040b5/icloud
- https://support.microsoft.com/en-gb/office/restore-deleted-files-or-folders-in-onedrive-949ada80-0026-4db3-a953-c99083e6a84f
- https://support.microsoft.com/en-gb/office/restore-your-onedrive-fa231298-759d-41cf-bcd0-25ac53eb8a15
- https://www.ncsc.gov.uk/guidance/recovering-a-hacked-account
- https://www.reportfraud.police.uk/