TL;DR - User said a week's worth of changes were missing from his Excel file (which was stored in his OneDrive Documents folder). Turned out he had attached the file to an email, and then started working off the attached copy which is stored deep in C:\Users\\AppData\... I found a copy of it that had his changes and saved the day, although not before checking every other possible location first. Interested? Read on...

--------------------------------------------------------------------------------------------------------------------

User came to IT in a panic as the spreadsheet that was due today was missing a week's worth of changes. The file with the missing changes was currently located in his OneDrive Documents folder so I checked versions first and noticed it had not been saved since a week ago. Prior to a week ago, the file had been saved numerous times (already had 39 versions) so something caused that to come to a grinding halt. Here's where I looked next:

• C:\Users\\AppData\Local\Microsoft\Office\UnsavedFiles
• C:\Users\\AppData\Local\Temp
• SharePoint Enterprise Search (on-prem SharePoint sites)
• SharePoint Search (SharePoint Online)
• File Server Shares (by filename).
• User's laptop event logs - for instances of the filename.
• SolarWinds Security Event Manager (SEM) - security/application/system events that included that filename.
• eDiscovery of Exchange Mailbox for file as an attachment

I even searched the entire C: drive for the file by its name.

I also ran an audit in Microsoft Purview using different search criteria on the off chance that he had done one of the following:

• Saved a copy of the file elsewhere (searched for its filename across all OneDrive, Sites and Mailboxes)
• Saved the file with a different name (searched for keywords unique to file across his OneDrive/Mailbox)
• Emailed a copy of the file to someone else (searched across all mailboxes and message trace logs for filename)

The file did not show up anywhere, and but I did find a couple clues:

• Laptop "Microsoft Office" event logs had a reference to the file being opened from Outlook
• Purview audit logs showed Outlook.exe was the last program to touch the file (not Excel.exe).

So I considered the possibility that he had attached the email so he could send it to somebody, but before he sent it, he decided to make additional changes, so he re-opened the file from the email attachment draft, NOT the file's actual location in OneDrive. I looked up where Outlook stores attachments when they are first opened, and found this path:

C:\Users\\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\

I looked in that folder and found 186 files from over the past year, with the most current one being a file with the exact same filename as the one that he was missing a week's worth of data from. The date on the file was today's date though, but hoping against hope, I copied the file over to my C: drive, renamed it, and emailed it to him asking if this file had the missing data. I got back a quick and resounding YES!

I'm still not sure how this happened. I tried emailing myself a file that was originally in my OneDrive and then went back to sent item, opened the attached file (which opened in the above 'content.outlook' folder), made a few changes and then clicked 'Save'. Office had me save it back my OneDrive. I can't get any changes to save to that temp folder. I wonder if I disconnected the network connection if it would let me.

Anyone run into a situation like that? I feel like I need to start a "all the places you can lose a file" document/guide. I also want to write a "places you should not be saving your work" document, which would include "Desktop". I didn't even ask about USB thumb drives or 3rd-party email systems. One lesson learned is that our powerful M365/Azure auditing doesn't cover files that are saved locally. And my Advanced Audit policies that are applied to our File servers, also don't cover the C: drive of a user's laptop. Feels like we might want to introduce C:\Users to the 'Advanced Audit' policy so we could have found the user's activity in that folder.