Home / OCI

OCIRunbookAdvanced

Sev1: OCI Object Storage objects deleted or overwritten — recover with versioning and replicas

Get deleted or overwritten objects back in OCI Object Storage. Stop the deleter, list object versions, restore previous versions, fall back to a replication target or backups, and use retention rules to block the next accident.

Deepak Bhardwaj2 min read

Applies toOCI Object Storage (Standard and Infrequent Access tiers), object versioning, retention rules, replication policies, OCI CLI 3.x

First: stop whatever is deleting

Disable the job, revoke the pre-authenticated request or customer secret key in use, and check lifecycle policies — a lifecycle rule that deletes objects will keep going.

oci os object-lifecycle-policy get --bucket-name prod-exports
oci os preauth-request list --bucket-name prod-exports --all

1. Is versioning enabled?

oci os bucket get --bucket-name prod-exports --query 'data.{versioning:versioning, replication:"replication-enabled", tier:"storage-tier"}'
Versioning What you can do
Enabled Previous versions and delete markers are kept — recover in place
Suspended Versions created while enabled still exist
Disabled Only a replica, a backup copy or the source system can help

2. List versions

oci os object list-object-versions --bucket-name prod-exports --prefix 2026/10/ --all \
  --query 'data.items[].{name:name, version:"version-id", latest:"is-latest", marker:"is-delete-marker", modified:"time-modified"}' \
  --output table

A deleted object shows a newest version that is a delete marker, with the real data in the version before it.

3. Restore a previous version

Copy the good version over the current object name. This works for deleted and overwritten objects and keeps history:

oci os object copy --bucket-name prod-exports \
  --source-object-name 2026/10/report.csv --source-version-id <good-version-id> \
  --destination-bucket prod-exports --destination-object-name 2026/10/report.csv

Copies run as work requests; check them with oci os work-request get --work-request-id <id>. For many objects, script the list from step 2: for each name, pick the newest version that is not a delete marker and copy it.

Caution

Deleting a specific version (oci os object delete --version-id) is permanent. Don't delete anything until the data is back and verified.

4. No versioning: other sources

  • Replication target bucket in another region: copy back with oci os object bulk-download / bulk-upload, or a copy request per object. Replication copies deletes, so check timing.
  • An export kept by the producer system: re-run it for the affected period.
  • Archive tier copies need a restore first: oci os object restore --bucket-name archive-bucket --name <obj> --hours 24.

5. Who deleted it

oci audit event list --compartment-id $C --start-time 2026-10-24T00:00:00Z --end-time 2026-10-24T12:00:00Z \
  --query 'data[?contains("data"."event-name", `DeleteObject`)].{t:"event-time", who:"data"."identity"."principal-name", ip:"data"."identity"."ip-address"}' --output table

Object-level events require the bucket's emit object events or service logging (write/read logs) to be enabled for full detail.

Prevent it next time

  • Versioning on every production bucket, plus a lifecycle rule that deletes previous versions after N days to control cost.
  • Retention rules (time-bound, optionally locked) for data that must not be deleted.
  • Cross-region replication to a bucket in a compartment managed by a different team.
  • IAM: apps get OBJECT_CREATE and OBJECT_READ but not OBJECT_DELETE unless they really need it.

Related fixes