#37413 Recycle Bin

Created from Lead: https://artichoke.shield.syncromsp.com/leads/40190317/convert

There is a lot of documents in the Recycle Bin that show they were deleted by Peter. This stood out to me because he was deleting files from cases folders that he doesn’t work on. Is there a way to restore everything that was deleted by Peter today? Screen shot for reference

[embedded image]

Good morning Peet. Can you please let me know when you think Peter will be able to access his account again? Thanks!

From: Artichoke Consulting <[email protected]>
Sent: Monday, March 2, 2026 3:50 PM
To: Shea Mann <[email protected]>
Subject: Thanks, we got your information: Recycle Bin (message id: 106970889)

All,

I reenabled Peter's account about 7:50AM just before emailing him a summary of events.

On Sunday, March 2nd, a large number of files were unexpectedly deleted from the DOCS/H/ folder on the firm's SharePoint site. As a precaution, I temporarily disabled Peter's account while I conducted a security audit to determine whether the account had been compromised.

After reviewing Microsoft 365 audit logs, I can confirm that Peter's account was not compromised. The deletions were caused by the OneDrive Sync client on his firm laptop. When a locally synced folder is deleted or moved on the workstation, OneDrive propagates that change to SharePoint, which is what happened here. Peter was working from Germany at the time and the deletion was unintentional.

I do want to flag that Peter's account is being actively targeted by external credential stuffing attacks -- automated login attempts using leaked credentials from the prior compromise. All of these attempts have been blocked by our MFA and Conditional Access policies, and no unauthorized access has occurred. This type of background noise is expected to continue, and security controls are handling it properly.

All 5,725 affected items (960 folders and 4,765 files) have been restored to their original locations in SharePoint.

I've attached the executive summary with detailed findings and recommendations for your reference.

Let me know if you have any questions.

Cheers.Peet

Of course I didn't attach the summary.

Cheers.Peet

Thanks Peet!! Do you know what he would have had synced that allowed files across multiple subfolders in H to be deleted without deleting the entire H folder?

From: Artichoke Support - Peet <[email protected]>
Sent: Tuesday, March 3, 2026 9:16 AM
To: Shea Mann <[email protected]>
Cc: Peter Ivins <[email protected]>; Hannah Higgins <[email protected]>
Subject: Recycle Bin (message id: 106970889)

Shea,
The 100% answer here isn't neccessarily clear, but what makes the most sense is the Files On-Demand feature of OneDrive.

With OneDrive Files On-Demand, not everything in the synced library is actually downloaded. Files show up in File Explorer as either:
- Locally cached (green checkmark) -- files he'd actually opened/used/viewed (or otherwise determined by OneDrive to cache locally)
- Cloud-only placeholders (cloud icon) -- visible but not downloaded

When the H directory was deleted, it appears taht only cached content was affected, so files in seemingly random locations were moved to the recycle bin. If you'd like a more concrete answer, I would likely need to dig deep into Peter's computeror attempt to recreate the conditions that could cause this type of deletion.

On the plus side, and regardless of the exact cause, all affected files have been restored to their original locations in SharePoint.

Cheers.Peet

I’m not sure what happened yesterday. Occasionally I will get popup messages from OneDrive about syncing not being completed and I tell it to stop because I have not used syncing to access files for at least a year. I did something that I thought was similar yesterday, which apparently led to the files being deleted. I’m not sure how I could have done that because I don’t think I accessed any of those folders before.

Peter B. Ivins

Williams Law Firm, PC

406-721-4350

From: Shea Mann <[email protected]>
Sent: Tuesday, March 3, 2026 9:18 AM
To: Artichoke Support <[email protected]>
Cc: Peter Ivins <[email protected]>; Hannah Higgins <[email protected]>; Mark Williams <[email protected]>
Subject: RE: Recycle Bin (message id: 106970889)

Thanks Peet!! Do you know what he would have had synced that allowed files across multiple subfolders in H to be deleted without deleting the entire H folder?

From: Artichoke Support - Peet <[email protected]>
Sent: Tuesday, March 3, 2026 9:16 AM
To: Shea Mann <[email protected]>
Cc: Peter Ivins <[email protected]>; Hannah Higgins <[email protected]>
Subject: Recycle Bin (message id: 106970889)

Peter,

If you're concerned we can take a look at your current settings/config. I would recommend switching away from any share point sync'd folders you may have to exclusiely using OneDrive Shortcuts. That said, while you're out of the country I'd recommend that you don't change anything that's currently working for you. No reason to tempt the fates.

Cheers.Peet

The files that were deleted were primarily from cases that Peter doesn’t work on so it doesn’t make sense to me that they would be cached on his computer. If you aren’t concern about it, I don’t know if the root cause is worth looking into, but I just find it strange.

[embedded image]

From: Artichoke Support - Peet <[email protected]>
Sent: Tuesday, March 3, 2026 9:36 AM
To: Shea Mann <[email protected]>
Cc: Peter Ivins <[email protected]>; Hannah Higgins <[email protected]>; Mark Williams <[email protected]>
Subject: Recycle Bin (message id: 106970889)