OneDrive Restore shows hundreds of changes but many entries are blank

Hi Xavier-D,

Following up on our thread from June, since I now have additional information that seems important.

You told me on June 26 that since both my Windows devices were fully powered off at the time, it was reasonable to suspect the June 7 deletions originated elsewhere - "another signed-in device, web/mobile access, shared folder activity, or a cloud-side/account-level change."

Around the same time, in a separate Microsoft Support case ([Moderator Note: Personal Info Removed], running in parallel), the support agent told me the opposite: that "the OneDrive service itself does not independently generate file changes without a prior trigger," and that the deletions were most likely local changes from a previous sync session that only became visible later.

Since then, a similar mass-deletion incident happened again on July 6, and this time I was able to analyze the local OneDrive Sync Engine diagnostic logs directly (decrypted using the client's own general.keystore). Immediately before 104 files were deleted, the logs show:

WnsClient::OnNotificationReceived (an incoming push notification) -> SyncServiceProxy::StartChangeEnumeration (a request to the server for changes) -> a server response (EnumChanges) -> every one of the 104 deletions tagged with the same internal trigger: DeletionTrigger::FindChangesTombstone

This looks consistent with your original explanation (something server/account-side), not with the "local session, delayed visibility" explanation I got from Support.

Could you help me understand which of these two explanations is more accurate? And is there a way to have this looked at by someone with access to server-side sync telemetry, given that the local logs point fairly specifically at a server-originated tombstone rather than a local-only event?

Thank you again for your time.

Hello Xavier,

Thank you for your detailed explanation.

I understand that blank entries in OneDrive Restore can be normal and may simply indicate that not every counted change is displayed in the activity list.

However, my main concern is different.

Before I created a complete backup of my OneDrive on June 19–20, I observed that some files disappeared without ever appearing in the OneDrive Recycle Bin.

After I created the backup, I only observed file removals that appeared in the OneDrive Recycle Bin.

This change in behavior is what I am trying to understand.

Have you ever seen a case where OneDrive first removed files without using the Recycle Bin and later started using the Recycle Bin normally?

Could this indicate a synchronization issue, a database inconsistency, or another known OneDrive behavior?

Thank you again for your help.

Disclaimer: Since you are using English language for this post, I will respond in the language you are using. As this is the Czech forum, you are welcome to let me know if you need me to respond in Czech. I respond in the language you are comfortable with. 

Hello Jindřich Širůček

I can see that you are having issue with OneDrive

Based on how OneDrive Restore works, the activity chart can show the total number of file changes for a day, while the activity feed is meant to show the individual file or folder actions.

If you are seeing large change counts such as 247, 136, or 95 but many rows appear blank, that usually means the Restore page is not giving enough visible detail for those counted activities.

To answer your questions:

• What do blank entries in OneDrive Restore mean? Blank entries usually indicate that the Restore activity feed is not showing the file name or action details for those specific counted changes. They should not automatically be treated as proof of unauthorized access, especially if your Microsoft account activity does not show suspicious sign-ins.
• Can OneDrive internally record changes that are not displayed in Restore history? Yes, the chart may still count activity even when the visible Restore feed does not clearly show every item. In other words, the count and the visible rows may not always give the same level of detail.
• Is there a way to identify which device or process created the changes? For a personal OneDrive, the user-facing Restore page does not provide a detailed device/process audit trail for each change. You can check Microsoft account sign-in activity, OneDrive Recycle Bin, Version History, and local device activity, but it may not show exactly which app or process triggered each Restore entry.

One important limitation: if files were permanently deleted from the OneDrive Recycle Bin, they may not be recoverable through the normal personal OneDrive recovery options. Restore your OneDrive states that if a file has been permanently deleted from the OneDrive Recycle Bin, it cannot be recovered.

For the blank activity rows in Restore your OneDrive, here are what you can try to fix this issue:

• Open OneDrive Restore from a private/incognito browser window This helps rule out cached browser data or a browser extension interfering with the Restore page display.
• Try a different browser For example, if you used Edge, try Chrome or Firefox, or vice versa. Since Restore is a web-based page, a rendering issue can sometimes affect how the activity feed appears.
• Clear browser cache and cookies for OneDrive/Microsoft sites Then sign back in to OneDrive on the web and open Settings > Options > Restore your OneDrive again.
• Try from another device or network This can help confirm whether the blank rows are specific to the current browser/device setup.

I hope these information help, feel free reply back to this post if you need further assistance. I'll be happy to help.