Skip to content
RansomwareBackup
recovery google workspace

Recover a deleted Google shared drive: the 30-day and 25-day clocks

A deleted Google shared drive or its files can come back from the Admin console for 25 days. Who can delete, who can restore, and what the window does not cover.

To recover a deleted Google shared drive, an administrator with the Drive & Docs privilege opens the Admin console and restores it, but only if it was deleted within the last 25 days. Individual files are a separate path: members can restore them from the shared drive's Trash for up to 30 days, and after that an administrator has a further 25 days, counted from the moment the file left the Trash. Both windows are documented by Google, both are measured in days rather than versions, and neither is a backup. This post sets out who can delete what, which clock applies to which kind of loss, and where the native recovery path stops.

The two kinds of loss, and the two clocks

Shared drives fail in two different ways, and they use different recovery tools.

What was lost Who restores it How long
Files or folders in a shared drive Managers, Content managers and Contributors, from the drive's Trash Up to 30 days
Files already removed from the shared drive's Trash An administrator, in the Admin console Items removed from the Trash within the last 25 days
A whole deleted shared drive An administrator, in the Admin console Deleted within the last 25 days

Google's own help page states the admin limit plainly: you can only restore items that were removed from the shared drive's trash within the last 25 days, "even if you have Google Vault retention policies in place". Retention does not extend the clock. If you want the same arithmetic for personal Gmail and My Drive, it is covered in recovering deleted Gmail and Drive files; shared drives follow a related but not identical pattern.

Who can delete, and who can restore

The permission model decides how fast a loss becomes permanent. From Google's documentation of shared drive roles:

  • Managers and Content managers can move files and folders to the Trash.
  • Managers, Content managers and Contributors can restore files from the Trash, for up to 30 days.
  • Only Managers can permanently delete files in the Trash.

That last line matters more than the 30 days. A Manager does not have to wait for the Trash period to run out; they can empty it. Google's help page describes a manager-only deletion flow for the drive itself, too: a shared drive has to be empty before a Manager can delete it, and to empty it you put the files in the Trash or move them to My Drive.

An administrator can skip that step. Google states that to delete a shared drive without emptying it or having access to it, you can use the Admin console. Which means the capability to remove a whole drive sits with two groups: its Managers, and anyone holding the Drive & Docs administrator privilege.

Recovering a whole deleted shared drive

If an entire shared drive is deleted, the Admin console is the route, and the steps are narrow:

  1. In the Admin console, open Apps > Google Workspace > Drive and Docs and go to Manage shared drives.
  2. Filter by Deleted status. Google notes that deleted shared drives stay visible in this list for 30 days after deletion.
  3. Choose Restore on the drive and select a date range.
  4. To get back every file that was in the drive when it was deleted, Google says you must select the date it was deleted up to the current date.
  5. Confirm with Restore data.

Two details trip people up. The restore is bounded by the 25-day limit, even though the drive remains listed for 30 days, so the list is not proof that the data is still recoverable. And Google calls out time zones: if you and the user who deleted the drive are in different zones, account for the difference when you choose the date range.

What the native path does not give you

Read the windows as what they are: a time-limited undo. Four limits are worth stating before an incident rather than during one.

  • The clock starts at deletion, not at discovery. A drive that is emptied and deleted on a Friday before a holiday has the same 25 days as any other. Nobody checks the shared drive list on holiday.
  • Restore is range-based. The admin tool works on a date range, so restoring one lost folder can mean restoring everything else that was removed in the same window. That can include files someone deleted on purpose.
  • Retention does not extend it. Google says the 25-day limit applies even where Vault retention policies exist. Vault is for preserving and exporting data, not for putting it back into a shared drive.
  • The data and the access live in one place. A shared drive's files belong to the team rather than to an individual, and when members leave the files stay put, which is a real strength. But it also means one drive, one set of Managers and one deletion path hold everything the team has.

The ransomware angle, stated carefully

We do not claim any control prevents ransomware; the useful question is what you can recover from. Shared drives are interesting here because of the permission model above. Ransomware that runs through a synced client writes new versions of files, and Drive's version history is the first thing to look at. A compromised account with Manager rights is a different case: by Google's own role table it can move files to the Trash and then permanently delete them, and the 25-day administrator window is what remains afterwards. That is an inference from the documented permissions, not a Google statement about attack patterns, but it is the reason the number of Managers on a shared drive is worth auditing.

The practical point: native recovery gives you a few weeks to notice, find the right date range and act, and it depends on an administrator account that is itself part of the environment under attack. A copy kept outside Google Workspace, on retention you set, is what removes that dependency. See how to back up Google Workspace for the routes Google offers and which of them is actually a backup, and what immutable backup guarantees for what makes a copy resistant to a privileged attacker.

A short audit you can run this week

  1. List your shared drives and their Managers. Fewer Managers means fewer accounts that can empty a Trash.
  2. Write down the 25-day rule where the person on call will find it, with the Admin console path above.
  3. Decide who holds the Drive & Docs administrator privilege and confirm each of them still needs it.
  4. Test one restore. Delete a file in a test shared drive, remove it from the Trash, and restore it through the Admin console, so the first time anyone does it is not during an incident.
  5. Compare 25 days with your obligations. If your business needs to restore data older than that, native tooling alone does not meet it.

Where to start

Shared drives tend to hold the work a team cannot afford to lose: project files, finance folders, shared templates. They are covered by exactly the windows above and nothing more. We help you choose and deploy the right fit for your stack, including Google Workspace, and get you protected with guided setup and onboarding. Book a Google Workspace backup assessment and we will map your shared drive recovery windows against what your business needs to be able to restore.