Guides › Unknown activity
Unknown changes or access in your cloud files?
Check the records your provider shows you — file activity and versions, who the file is shared with, and the devices and sessions on your account — then remove what you don’t recognise and secure the account. Treat these records as clues: they don’t list every viewer and can’t prove who was using an account.
Where you noticed it
Look in: More → Manage versions, then google.com/devices
Drive activity shows changes and who made them (SE17); versions are under More → Manage versions (SE75). Devices on the account: google.com/devices (SE08).
What each record can tell you
Steps
- Open the file’s historyGoogle Drive: select the file → More → Manage versions (SE75); activity shows changes and who made them (SE17). Dropbox: the file → Version history shows who added it (SE57). Drive versions may go after 30 days or 100 newer versions (C07), so pin the one you need with Keep forever (SE18).
- Work out who can open it, and howDrive: the owner and anyone with edit access can change sharing (SE14), so an editor may have shared it on; Share → General access → Restricted limits opening to people with access (SE78, SE15). iCloud.com: Share → Manage Shared Folder → Stop Sharing (SE84, SE85); sharing is set per folder, not per file (SE55). Dropbox: the Sharing page shows whether the file sits in a shared folder (SE58).
- Replace a link instead of editing itOneDrive: Details → Stop sharing (SE76, SE77). You can’t change a sharing link from edit to view or back; delete the link and create a new one with the permission you want (SE45). Anyone holding the old link loses it, so send the new one only to people you choose.
- Read the device list with its caveatsGoogle: google.com/devices → Manage all devices (SE08, SE74); the times are the last contact with Google, not last use (SE09), and several sessions of one type may be one device or many (SE10). Apple: account.apple.com → Devices (SE89). Dropbox: Security tab → hover the “i” icon for the last IP (SE73, SE91); the country may be wrong (SE64).
- Review sign-in activityGoogle: “Recent security events” → Review security events (SE02). Microsoft: Security basics → Review activity, then “This wasn’t me” for anything unusual (SE88, SE86, SE30). On a Dropbox team, ask the admin first — they may have used Sign in as user (SE59).
- Secure the account if anything stays unexplainedGoogle recommends securing the account if someone accessed your Drive without permission (SE19). Sign out the devices you flagged in step 4, remove linked apps you don’t use — revoking one stops its further access (SE13) — and restore changed files from the versions you pinned in step 1. The full order is in the guide on files changed after an account was misused.
What the records show — and what they don’t
| Provider | File changes | Devices and sign-ins | Not described in the official help |
|---|---|---|---|
| Activity shows changes and who made them (SE17) | google.com/devices; times are the last contact with Google (SE08, SE09) | A full list of viewers for a personal Drive | |
| Microsoft (OneDrive) | Version history kept 30 days (C13) | Recent activity page (SE29, SE86) | A per-file activity log for personal OneDrive |
| Apple (iCloud Drive) | Sharing is set per folder — a file inside a shared folder can’t have its own settings (SE55) | account.apple.com → Devices (SE89) | A file-activity log for iCloud Drive |
| Dropbox | Version history shows who added a file (SE57) | Country of last IP per device (SE61); not always accurate (SE64) | How long account activity is kept |
SE-codes point to quotes in the account-security fact journal, C-codes to the main one. The last column lists what we looked for and did not find; your plan or admin console may show more.
What a record can’t prove
A record names an account, device or session, not a person. Google notes that several sessions of one device type may be one device or many (SE10), and that a listed time can be more recent than your last use, because background sync counts (SE87). Dropbox location comes from the IP and may show the wrong country (SE64). Shared content can travel too: Google says you can’t stop how others share the file content in other ways (SE16). For your own account these clues are enough to act — secure it and remove access. They are not a way to look into anyone else’s account, and this site doesn’t help with that.
Limits: when nothing is left
- History expired. Drive may remove versions after 30 days or 100 newer versions (C07); OneDrive keeps version history 30 days (C13).
- Already copied. Removing access stops future opening, but you can’t stop how others share the file content in other ways (SE16).
- Admin access. On a Dropbox team, an admin may have used Sign in as user (SE59) — ask the admin.
- Not your file. Only the owner can stop sharing an iCloud item (SE54); on OneDrive the owner can stop sharing a file (SE44) — if it isn’t yours, ask the owner.
Questions
Can I see everyone who viewed my file?
The official help we read does not describe a full viewer list for personal Drive, OneDrive, iCloud Drive or Dropbox. Records show changes, sharing and sign-ins.
The device list shows a city I’ve never been to.
Location is approximate. Google may show a nearby place, and Dropbox shows the country of the last IP and says it isn’t always accurate.
A session time is newer than my last use.
Google says listed times are the last communication with its systems, including background syncing, so they can be more recent than your last use.
Unfamiliar files appeared in my Dropbox.
Dropbox suggests opening Version history to see who added them and checking the Sharing page — another member of a shared folder may have added them.
Does an unknown change mean my account was taken over?
Not always: a shared-folder member, a linked app or your own second device can explain it. If nothing does, secure the account.
Can I find out who is behind another account?
No. These records describe your own account and files. This site doesn’t help look into other people’s accounts.
How long are activity records kept?
The official help we read gives no single period for activity. File versions: Drive may drop them after 30 days or 100 newer versions; OneDrive keeps version history 30 days.
Sources Checked October 2026
- Google Drive Help — Check activity & file versions
- Google Account Help — See devices with account access
- Google Account Help — Share some access to your Google Account data with apps from other developers
- Microsoft Support — What happens if there’s an unusual sign-in to your account
- Microsoft Support — Manage sharing and permissions in OneDrive and SharePoint
- Apple Support — Manage sharing for files and folders in iCloud Drive on iCloud.com
- Dropbox Help — If you think your account was compromised
- Dropbox Help — How to protect your Dropbox account if it’s been compromised