Documents deleted by SharePoint every Friday morning

Question

Hi all,

Every Friday morning for the past month, hundreds of documents are deleted by SharePoint on one of our Site Collections. It is not isolated to one document library. I have setup alerts when a document is deleted but never get an alert when SharePoint deletes documents on Friday morning. I always get an alert when a user deletes a document so I know it works and a user is not the one deleting all these documents. The document libraries have no IM policies or workflows applied. The only setting is "Create major and minor versions" and Yes to "Require documents to be checked out before they can be edited". I have checked all logs on the server and also checked Audit Log Reports but it does not show SharePoint deleting documents. The Recycle Bins also do not have the deleted documents showing.

I know the documents are missing since I can restore the previous night's backup and compare both site's content.

Any help or direction on this issue would be appreciated.

Thanks,

Jody

Answer 1

That is very interesting, but since there is no record of the item being deleted via SharePoint the the only logical assumption is to look at where SharePoint stores its content i.e. the Content Database. Do you have any jobs, triggers, maintance plans, etc looking at the database in question, how about putting a SQL Profiler on the Content Database in question and look at it from the back end.

Other than that, you stated that there is no Record Center, or IRM on the DL's right? that is the only other thing i can think of..

Happy Hunting

Fabian Williams
Blog: http://fabiangwilliams.wordpress.com
Twitter: www.twitter.com/fabianwilliams

Answer 2

On one of the document libraries, go to the library's settings, and click on "information management policy settings".  Look to see if there's a current policy associated with the library.  If so, you may need to navigate to the site collection level, and in Site settings, go to "site collection policies".  In the "expiration" policy section of the policy in question, look to see if there's a setting to delete items after a certain amount of time after they've been created.

This policy could easily been set up by someone at the site collection level, and been applied to a content type.  This would have ensured that all doc libraries created as that content type would have this policy applied to them, and their documents would be set to delete every night.

---

Laura Rogers, MCSE, MCTS
SharePoint911: SharePoint Consulting
Blog: http://www.sharepoint911.com/blogs/laura
Twitter: WonderLaura

Answer 3

There are no IM policies applied to any of the libraries or at the Site Collection level. Content types are also not being managed or used.
 
It seems that most of the documents that have been deleted have multiple minor versions but considerably less than the 511 drafts allowed by SharePoint. There are no limits set on how many versions can be kept under Version settings.

The Audit Reports also show that the Farm Search Service Account has "viewed" the documents prior to them being deleted but the deletion is not reported in the Audit Reports. In addition, I have disabled the scheduled crawler in the SSP.