OneDrive and iCloud Placeholders Aren't Files. Check the Cloud Before You Pay for Recovery.

Written and maintained by the Desert Data Recovery lab team. · Updated October 13, 2026

We already wrote about what a lab can and cannot do after ransomware, about a real backup, and about a modern Mac whose iCloud sync is not a second copy. This page is the folder that looked full. The icons were doing the work. The disk was not.

The icon is a status, not a copy

Microsoft's Files On-Demand page says that starting with OneDrive build 23.066, Files On-Demand is on by default. Synced files show up in File Explorer. They do not all live on the PC. The same page, and Microsoft's "Work with synced files in File Explorer" page, describe three states:

• Blue cloud. Online-only. The file does not take space on the computer. It does not download until you open it. You cannot open it offline. Desktop search can find it by name and cannot search inside it, because it is not stored on the device. The same page lists thumbnails of over 300 file types as something Files On-Demand can show even when you do not have an app that opens them. A thumbnail beside a cloud icon is not the document.
• Locally available. Opening an online-only file downloads it. You can open that copy with no internet. Right-click, Free up space, and it goes back to online-only. With Storage Sense on, Microsoft says these files become online-only after the period you selected.
• Green circle, white check. Always keep on this device. You pinned it. OneDrive downloaded it. It takes space. It is there offline. Storage Sense does not manage a file marked this way.

A synced SharePoint library uses the same icons. So does a Desktop, Documents, or Pictures folder after you turn on OneDrive folder backup. Microsoft's backup page says those folders are then available across your devices. They are still Files On-Demand folders: a file another PC uploaded can arrive as a cloud icon, and a file you saved on this PC starts out local until something frees it. "It was in Documents" tells you the folder. The icon tells you whether that PC held the bytes.

Apple's current Mac User Guide, on the iCloud Drive status page, is the other list. Turn on the iCloud Status column in Finder. In iCloud means the item is only in iCloud; you need a connection unless you Control-click and choose Download Now. Downloaded means it is up to date on the Mac and opens with or without a connection. Keep Downloaded means it stays on the Mac even when the Mac needs space. Waiting to Upload means it is not in iCloud yet. Out of Space means iCloud storage is full, so the item was not stored there. Ineligible usually means the item is over the 50 GB limit Apple states for one file or folder in iCloud Drive, so iCloud refused it. Apple notes that the status icon next to the name is hidden for downloaded items. Read the iCloud Status column before you decide a file was local.

Freeing space takes the bytes off the device and leaves them in the account

Microsoft's Files On-Demand page is direct: changing a file to online-only does not delete it from OneDrive. The file stops taking space on that device. You can still open it on the website or in the mobile apps. Free up space is that change, done by hand.

Storage Sense is the automatic version, and Microsoft's Storage Sense page is more careful than the forum posts. Storage Sense is off by default. If the PC runs low on space and you have never touched the feature, Microsoft may turn it on to clean temporary files and then tell you. With the default settings, Microsoft says Downloads and OneDrive (or any other cloud provider) are not touched unless you set that up. The same page then says that starting in Windows 11, version 22H2, the default for the OneDrive control — "Content will become online-only if not opened for more than" — is 30 days. Both sentences are on the page. A pin, Always keep on this device, is exempt either way. The setting does not permanently delete the file. We will not tell you that every Windows 11 PC silently dehydrated your Documents folder last month. We will tell you that a file you did not pin can be online-only, and that the cloud copy is the one Microsoft says remains.

One more split from the same Files On-Demand page. The default called Free up disk space makes new files from the cloud, or from another device, online-only. Files created on that device are available offline by default. A Word document you saved on the laptop started as a local file. A folder that appeared because another PC uploaded it started as a cloud icon, unless that folder was pinned. Download all files is the setting that pulls the whole OneDrive folder down, which Microsoft says matches Always keep on this device for the entire folder.

Apple's wording is "when space is needed," not "always." The iCloud Drive page in the Mac User Guide says the Mac can store documents in iCloud when it needs room, and that if space is not needed the full contents of iCloud Drive stay on the Mac. Optimize Mac Storage is the switch. The same guide's "Work with folders and files in iCloud Drive" page says that with Optimize Mac Storage on, older documents are stored in iCloud when space is needed, and that Keep Downloaded holds the ones you mark. Remove Download takes a downloaded item back off the Mac. The item remains in iCloud. Apple's separate Optimize Storage recommendation also describes keeping recently opened files on the Mac when space is needed. That is the same idea, aimed at the storage screen. It is not a statement that every file you saw in Finder last year is still on the SSD.

Check the account before you pay anyone

Use a browser, on a different computer. Sign in at onedrive.com or icloud.com. Do not install the sync client yet.

OneDrive, personal. Microsoft's "Restore files deleted from your OneDrive" page says items in the recycle bin are kept for up to 30 days. Files deleted from the cloud, including online-only files, are not in the Windows Recycle Bin or the Mac Trash. Restore them on the website. If Personal Vault was in use, Microsoft's tip on that page says use Show Personal Vault items in the recycle bin; the vault has to be unlocked for those deletes to show. Microsoft's "Restore your OneDrive" page says a Microsoft 365 subscription can roll the whole OneDrive back across the last 30 days when files were deleted, overwritten, corrupted, or hit by malware. If automatic ransomware detection already ran, a suggested date may be filled in. Files and folders created after the point you pick go to the recycle bin. Albums are not restored. The same page says a file permanently deleted from the OneDrive recycle bin can never be recovered. Microsoft's version-history page says previous versions are retained for 30 days, and that a work or school administrator may have turned versioning off. Microsoft's Office page "View previous versions of Office files" says a personal account can retrieve the last 25 versions. A day count and a version count are both printed. Use whichever list the site actually shows you. Do not assume a 31st day is still there because a different page mentioned 25 copies.

OneDrive, work or school. The same restore page says 93 days, unless the administrator changed it. Microsoft's article on the site collection recycle bin, which covers OneDrive files deleted from a SharePoint site, says the 93 days start when the item leaves its original place. Emptied from the first bin, it can remain in the second-stage bin for the rest of that window, unless the bin hits its quota and purges older items, or an admin deletes it. A site collection admin restores from that second bin. The same article says SharePoint Online keeps backups for 14 additional days beyond actual deletion, and that an admin can contact Microsoft Support inside that window when the recycle bin and Restore your OneDrive cannot bring the content back. That 14-day sentence is on the SharePoint admin article. The personal Restore your OneDrive page says "never" once the recycle bin has purged the file. A personal account should not plan on the 14-day path. A work account should ask the admin, this week, not a lab six months from now.

iCloud Drive. Apple's iCloud User Guide says files deleted in the last 30 days can be recovered, including deletes made on another device that had iCloud Drive on. Recently Deleted is at icloud.com/iclouddrive, for iCloud Drive and iWork apps. Restore Files is at icloud.com/recovery — the Data Recovery entry on iCloud.com — for files deleted from other apps. Apple says you cannot recover a file you permanently removed. While Restore Files is running, do not edit or delete anything in iCloud Drive. Apple's missing-files article is stricter: browsing iCloud Drive in another browser window during that recovery can interrupt it. Download the restored files after the job finishes, to a folder outside iCloud Drive. iCloud Photos and an iPhone's iCloud Backup are different switches. The phone version of "check iCloud first" is the iPhone page.

A sync client will upload a deletion, and it will upload an encrypted copy

Microsoft's Files On-Demand page says deleting an online-only file on the device deletes it from OneDrive on every device and online. You get it back from the web recycle bin, for the 30 or 93 days above. A locally available file also lands in the device recycle bin. That is why a cleanup on a new PC, an empty-folder sync, or a "free up space" habit on the wrong machine can finish a loss the dead drive started.

Ransomware is the same pipe. Files that were locally available can be rewritten and uploaded. Microsoft's Restore your OneDrive page lists malware as one of the reasons to roll the account back, and it mentions automatic ransomware detection filling in a date. Detection is not a promise that it fired, and a lab still cannot decrypt a current strain. If a machine is still powered and still encrypting or deleting, disconnect it. Quit OneDrive if you can do that without another reboot of a dying drive. Leave iCloud alone except to sign in on the web. Do not sign that account into a second computer and turn on folder backup, Optimize Mac Storage, or a "clean up duplicates" pass. Microsoft documents that a delete of a synced file is a delete everywhere. Apple documents that a delete on one device with iCloud Drive on is a delete you then have 30 days to undo. Checking the website is the careful sign-in. Installing the sync app and tidying the folders is the other one.

iCloud sync is also not a backup. We said that on the soldered-SSD page: it mirrors deletions. OneDrive folder backup is a sync of Desktop, Documents, and Pictures, with the retention windows above. A second copy you can restore after the account itself is damaged is the 3-2-1 problem. It is a different product from the placeholder in Finder.

What was actually on that disk

These are the files a failing drive can still hold, and the reason to image it:

• Pinned. Always keep on this device, or a folder you pinned, on Windows. Keep Downloaded on the Mac. Microsoft and Apple both say those copies stay on the device and take space.
• Downloaded and not yet freed. You opened it, or OneDrive says files created on that device start available offline. Finder status Downloaded. The bytes were local until Free up space, Remove Download, Storage Sense, or Optimize Mac Storage took them back.
• Never made it to the cloud. Waiting to Upload, Out of Space, and Ineligible (Apple's 50 GB example) are the opposite of a placeholder. The account does not have them. The disk might.
• A previous download that was later evicted. Free up space and Remove Download are designed to stop storing the contents. Neither vendor publishes a retention time for the clusters that used to hold them. On a hard drive that has barely been written since, a lab can search for remnants. On an SSD, TRIM and later writes often remove them. We will not know which, from a cloud icon in a screenshot, and we will not quote a rate.

What the disk holds for a file that was only ever online-only, or only ever In iCloud, is the directory entry and, on Windows, the thumbnail Microsoft already told you the client can show without the contents. Recovery software that lists those names is reading the placeholder. It is not finding the document. There is no hidden OneDrive or iCloud folder we can open to pull a full copy of a file the vendor says was never stored on the device.

What to do right now

1. If something is still syncing a deletion or an encryption, disconnect that machine from the network. If the drive is clicking, freezing, or the Mac will not boot, power it down and leave it down. Do not reinstall Windows or macOS, do not initialize the disk, and do not run a repair that writes. Those are Initialize Disk and a Mac that will not boot.
2. In a browser, check the account. OneDrive recycle bin, version history on the files that matter, and Restore your OneDrive if you have Microsoft 365. iCloud Drive Recently Deleted, then Data Recovery at icloud.com/recovery if the file is not in Recently Deleted. Write down the dates you are inside: 30 days for a personal OneDrive recycle bin and for iCloud, 93 days for work or school OneDrive unless an admin changed it, 30 days of OneDrive restore activity for a Microsoft 365 subscriber.
3. Download the files to a different disk, into a folder that is not under OneDrive and not under iCloud Drive. Open a few of them there. During an iCloud Data Recovery job, leave iCloud Drive untouched until it finishes.
4. Do not sign the sync client in on a new computer to "see if the files come back." Files On-Demand will show you the cloud catalog as placeholders. That view does not copy the dead disk, and a delete or a folder-backup setup on the new machine writes the account. Folder backup of Desktop, Documents, and Pictures can be turned on later, after you have the copies.
5. If the files you still need were pinned, downloaded, created on that machine, or never uploaded, and the drive is failing, stop. Photograph any status icons you can still see, then pack the drive or the laptop. How to ship a failed drive. If BitLocker or FileVault is on, bring the key. The key unlocks bytes that were local. It does not fetch an online-only file.

How a lab handles it

We ask what onedrive.com and icloud.com still show before we treat a cloud icon as a recovery. If the account has the files, the job is a download, and it is yours to do. We do not have a back door into a Microsoft or Apple account, and we do not need the original disk to retrieve a file that never left the cloud.

If the drive is dying and the files were resident — pinned, still downloaded, or never uploaded — we image it write-blocked, as far as it will read, and the file work happens on the copy. That is the same job as any other laptop drive. Placeholder names and thumbnails come along for the ride. They are not a substitute for the file. A file that was hydrated and later freed is a search of leftover space, with the SSD limit above, and we will tell you if the image does not contain it.

Encryption of a local copy is a different problem. FileVault, the T2, and Apple silicon are the Mac encryption page. A BitLocker key still means image first. Neither one recreates an evicted file.

The public case log has no OneDrive Files On-Demand intake and no iCloud Drive placeholder intake. We will not invent one. We don't advertise a success rate, and we can't promise a turnaround from an icon. The evaluation is at Desert Data Recovery, in the Phoenix area. The number on this page is (602) 686-2622. For the drive itself, see laptop data recovery and Apple and Mac data recovery.