What to do if…
your “recently deleted” folder is emptied and you did not empty it
Short answer
Pause syncing if you can, immediately check provider recovery routes (trash/recycle, version history, backups, web recovery), then secure the account (password + 2FA + remove unknown sessions) without locking yourself out.
Do not do these things
- Don’t keep using the device heavily (new photos, installs, big downloads) while you’re trying to recover data.
- Don’t factory reset or “wipe” anything as your first move—you can destroy evidence and reduce recovery options.
- Don’t trust “recovery services” that contact you first or demand urgent payment—use official provider support.
- Don’t skip evidence: once you sign out devices or revoke access, the screens/logs you need can change.
What to do now
-
Stop the sync spiral.
If practical, enable Airplane Mode or disable Wi-Fi/cellular data to prevent additional syncing deletions while you check from a second trusted device or the provider’s web dashboard. -
Record what you see (fast).
Screenshot: the empty “recently deleted/trash,” any “recent activity/security events,” and the list of signed-in devices/sessions. Write down when you noticed and which device you were using. -
Check every recovery layer for your specific service.
Look for (as applicable to that provider):- The provider’s Trash/Recycle area (cloud and/or local)
- Version history / “restore previous versions” for files and folders
- Any “restore your storage to an earlier time” feature (some services offer a full rollback)
- Your backups (external drive backups, Time Machine, Windows File History, etc.)
-
Verify whether someone else had access.
In your account security page, review recent sign-ins/security events and all devices. If anything is unfamiliar, treat the account as compromised. -
Secure the account in this order (to avoid lockout).
- Confirm your recovery email/phone are still yours.
- Change the password (and any reused passwords elsewhere).
- Turn on 2FA / two-step verification.
- Sign out unknown devices and remove suspicious third-party app access.
-
Use official support to request any available server-side recovery.
Contact the provider via their official help path and state: “My ‘recently deleted’/trash was emptied without my action. Is administrative recovery possible, and do you see signs of unauthorized access?” Share timestamps and screenshots. -
If this involved fraud, extortion, or cyber-enabled crime, report it through official channels.
- Use the FTC guidance for recovering hacked email/social accounts and next protective steps.
- File a report with the FBI’s Internet Crime Complaint Center (IC3) for cyber-enabled fraud/scams.
- If you think your identity information may be misused beyond this account, start at IdentityTheft.gov.
What can wait
- You don’t need to decide right now whether recovery is “impossible” until you’ve checked backups/version history and asked official support.
- You don’t need to migrate services today—focus on recovery + account security first.
- You don’t need to message all contacts unless there’s clear evidence your account is sending spam/scams.
Important reassurance
When trash/recently deleted is emptied, it often happens due to syncing across devices, shared access, or unauthorized sign-in—not because you did something “wrong.” Calm, ordered steps (pause sync → check recovery layers → secure access) give you the best chance to limit damage.
Scope note
This is first-step guidance to stabilize the moment, reduce further loss, and route you to the right recovery/security actions. Deeper cleanup (malware checks, device rebuilds, long-term backup design) can come after you’ve secured the account and exhausted recovery options.
Important note
This is general information, not a guarantee of recovery. Policies and recovery windows vary by provider and settings. If anyone pressures you to pay urgently or to install remote-control software “to recover your files,” stop and use official provider support channels instead.