Folder and contents within an ADLS blob deleted, no records within logs

Question

Folder and contents within an ADLS blob deleted, no records within logs

LanceKramer-6297 20

Between the hours of 3:00 PM CST on 6/4/2025 and 8:20 AM CST on 6/5/2025, a folder and it's contents were deleted from one of our storage containers. This folder is not within our deleted items (we have 7 day retention enabled), and I cannot locate any logs of it's deletion within our Azure monitor logs. I'm confident in the timeframe, because the alert that this file path did not exist came from the failed refresh of a Power BI report in the service, which was last successfully refreshed on 6/4/2025 at 3:00 PM CST. This led me to review ADLS, and that's when I could not locate the folder or it's contents. Are there additional records Microsoft has access to that can give me a data/time of deletion of this folder and it's contents?

Hari Babu Vattepally 3,270 Reputation points Microsoft External Staff Moderator

2025-06-05T20:33:37.32+00:00
Hi @LanceKramer-6297,

In addition to the below Answer provided by Pradeep. Please refer the below suggestions.

Please check if you have soft deletion enabled, deleted items are retained for seven days. Given that the folder is not in your deleted items, it might have been deleted beyond this retention period or not properly captured.

Also, please find that Azure Storage provides server-side logs that can assist in identifying deletion operations. If the logs do not contain any record of the deletion, it may suggest that the deletion was carried out by a process or user that did not generate a log entry, or that the logs were not preserved for that specific period.

Additionally, you can review the client-side logs generated by the Storage Client Library, as they might offer more detailed information about the requests sent to the storage service.

However, please check if the deletion was logged, you can find it in the Azure Monitor or Diagnostic settings. Also, please run the below command in Log Analytics of the storage account.

StorageBlobLogs | where TimeGenerated between (datetime(2025-06-04T15:00:00) .. datetime(2025-06-05T08:20:00)) | where OperationName == "DeleteBlob"

If in case, you see that the logs are missing, make sure that diagnostic settings are enabled for Blob Storage.

Also, please find that you can also check for logs in Azure Portal>> Monitor>> Activity log and filter by DeletedBlob operations within the timeframe.

For more additional information, please refer the below documents:

Best practices for Azure Storage data protection, backup, and recovery

Monitor, diagnose, and troubleshoot Microsoft Azure Storage (classic)

Hope this helps!

Kindly let us know if the above helps or you need further assistance on this issue.

Please don’t forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Accepted answer

0 additional answers

Your answer

Answer 1

Pradeep Kommaraju 625 Microsoft Employee

Hi Lance,

What Might Be Happening

If your storage account is using ADLS Gen2 with hierarchical namespace (HNS) enabled (which is common), then unfortunately soft delete doesn’t apply to folders or files in the same way it does for regular blob storage. Even if soft delete is turned on, deleted folders in ADLS Gen2 are often permanently removed.

Also, if diagnostic settings weren’t specifically set up to log DeletePath or DeleteBlob operations, those deletions might not show up in Azure Monitor—even if logging is generally enabled.

**
What You Can Still Do**

Check Activity Logs in the Azure Portal for the storage account. These logs are at the control plane level and might show who or what triggered the deletion.
Check if Blob Versioning was enabled. If it was, you might be able to restore a previous version of the deleted files.
Reach out to Microsoft Support. Since you know the exact time window and path, they may be able to pull backend logs that aren’t visible to customers. Be sure to include:
- The storage account name
- The container and folder path
- The time window (3:00 PM CST on 6/4 to 8:20 AM CST on 6/5)
- Any alerts or correlation IDs (like the Power BI refresh failure)

Do let me know if this was helpful with accepting the answer or do let me know if you have any follow up questions on the same .

Thanks

LanceKramer-6297 20 Reputation points

2025-06-05T19:49:26.0266667+00:00
Are you certain it doesn't apply to folders or files? There are two soft-delete functions:

Enable soft delete for blobs

"Soft delete enables you to recover blobs and directories that were previously marked for deletion"

https://learn.microsoft.com/en-us/azure/storage/blobs/soft-delete-blob-overview

Enable soft delete for containers.

"Soft delete enables you to recover containers that were previously marked for deletion."

Also, attempting to contact Microsoft Support via Azure seems to send me through decision trees that never actually allow me to contact support.
Pradeep Kommaraju 625 Reputation points Microsoft Employee

2025-06-05T20:22:30.49+00:00
I totally get your frustration with the support flow. To bypass the decision tree:

Go to https://portal.azure.com

Click the “?” (Help) icon in the top-right corner

Select “Help + support”

Then click “Create a support request”

Choose Technical > Storage > Data loss or recovery
LanceKramer-6297 20 Reputation points

2025-06-05T20:35:25.7433333+00:00

That's where I was, it's requiring me to describe my issue, select a service and resource, and then sends me on endless loops... There's no "Technical > Storage > Data loss or recovery"
Pradeep Kommaraju 625 Reputation points Microsoft Employee

2025-06-05T20:54:43.71+00:00

Try to scroll to the bottom of page and review the following section it will let you create the support ticket without going through that loop

Share via

Folder and contents within an ADLS blob deleted, no records within logs

0 additional answers

Your answer