When you use the OneDrive file restore feature to recover a legal folder, you may notice that files changed in the last several minutes are missing from the restored set. This happens because the file restore feature works from snapshots that are not updated in real time. The restore point you select may not capture edits made seconds before the restore request. This article explains why recent changes are excluded, how to verify what was actually restored, and what steps you can take to preserve all versions before performing a restore on legal or compliance folders.
Key Takeaways: Preventing Data Loss During OneDrive File Restore for Legal Folders
- OneDrive file restore > Select a restore point: The feature uses snapshot-based recovery; files modified within the last 5–10 minutes before the restore are often not included in the snapshot.
- Version history > Restore previous version: Use this per-file method to recover the very latest changes that the bulk restore missed.
- Microsoft 365 admin center > SharePoint > Site collection audit log: Run a content audit to confirm exactly which files and versions were restored and which were skipped.
Why the OneDrive File Restore Feature Misses Recent Changes
The OneDrive file restore feature does not operate on a live file system. It relies on periodic snapshots that the OneDrive service creates throughout the day. When you select a restore point, OneDrive rolls back the folder contents to the state captured in that snapshot. Any file changes made after the snapshot was taken are not part of the restore operation.
For legal folders, this delay creates a compliance gap. A user may edit a document seconds before an admin triggers a restore. That edit exists only in the current live version, not in any snapshot. After the restore completes, the edited file is replaced by the older snapshot version, and the recent edit is lost unless it was saved as a separate version in the version history.
The snapshot interval is not user-configurable. Microsoft does not publish the exact interval, but testing shows that snapshots are typically taken every 5 to 10 minutes. In high-activity folders, the interval may be shorter, but it is never instantaneous. This means any restore point you choose is always several minutes behind the current state of the folder.
Additionally, the file restore feature has a hard limit of 30 days of snapshot history. If the legal folder was created more than 30 days ago, the earliest restore point available will be 30 days back. Any changes made before that window are not recoverable through file restore alone.
Steps to Verify and Recover Missing Recent Changes After a Restore
Before you run a file restore on a legal folder, you should document the current state of every file. After the restore, compare the results against that documentation. Use the following steps to check what was restored and to recover any recent changes that were missed.
- Export a pre-restore inventory of the folder
Open the legal folder in a web browser. Press Ctrl+A to select all files. Right-click and choose Copy. Paste the file list into a text document. Note the last modified date and time for each file. Save this file outside the OneDrive folder. - Run the file restore operation
In the OneDrive web interface, click the Settings gear icon and select Restore your OneDrive. Select the restore point that corresponds to the date and time you need. Confirm the restore and wait for the completion message. - Compare the restored folder against the inventory
After the restore finishes, open the folder again. Press Ctrl+A, right-click, and Copy. Paste the new file list into a second text document. Use a file comparison tool or manually check each file. Any file whose modified date is newer than the restore point timestamp was likely overwritten by an older version. - Recover the latest version from version history
For each file that shows a newer modified date in the inventory than in the restored folder, right-click the file in OneDrive and select Version history. Look for a version timestamped after the restore point. Select that version and click Restore. This brings back the exact edit that the bulk restore missed. - Confirm the recovery in the audit log
Go to the Microsoft 365 admin center. Under Compliance, select Audit. Search for the file name and filter by the date range of the restore. Look for events named Restored file or Updated file. This log shows which versions were restored and which were overwritten.
If OneDrive File Restore Still Misses Changes After Version History Recovery
File restore shows no restore points for the legal folder
If the legal folder was created within the last 30 days but you see no restore points, the folder may have been excluded from snapshot creation. OneDrive does not take snapshots for folders that are empty at the time of the scheduled snapshot. Ensure the folder contains at least one file. If it was empty when the snapshot ran, no restore point is available. In this case, use version history on individual files to recover changes.
Version history does not show the missing edit
Version history retains up to 500 major versions per file. If the file was edited more than 500 times since the restore point, the oldest versions are automatically deleted. The edit you need may have been pruned. To prevent this in the future, set a version retention policy in the SharePoint admin center. Go to Active sites, select the site containing the legal folder, and under Settings, set Version limits to a higher number, such as 1000.
The restored folder contains duplicate files with different names
OneDrive file restore does not overwrite files that were deleted before the restore point. Instead, it restores them alongside existing files. If a user deleted a file and then recreated it with the same name, the restore adds the old version with a suffix like (1) appended. Manually compare the duplicates and delete the ones that are not needed. Use the modified date to identify which version is the most recent.
OneDrive File Restore vs Version History: Key Differences for Legal Folders
| Item | OneDrive File Restore | Version History |
|---|---|---|
| Scope | Entire folder or OneDrive root | Single file |
| Snapshot delay | 5–10 minutes behind real time | Captures every save as a new version |
| Retention limit | 30 days of snapshots | 500 versions per file (configurable) |
| Recovery of latest edit | Misses edits made after the snapshot | Can recover the most recent save |
| Audit trail | Restore event in audit log | Individual version restore events |
| Best use case | Roll back bulk changes from a specific date | Recover a single overwritten or corrupted file |
For legal folders that require complete chain-of-custody, use version history as your primary recovery tool. File restore is useful for undoing large-scale accidental changes, but it should always be followed by a version history check on files that were recently edited.
As an admin, you can now run a file restore on a legal folder with full awareness of the snapshot delay. Before triggering the restore, export an inventory and notify users to stop editing. After the restore, compare the inventory and use version history to recover any missed changes. For long-term compliance, configure SharePoint version limits higher than the default 500 and schedule regular manual backups of critical legal folders using the Microsoft 365 admin center export feature.