Where can I find deleted Incidents?

[rlegters]

I used the ODBC connector to create a report of Incidents for March. We're doing some review of high priority Incidents, and have discovered 6 incidents that show up in the report that are no longer in the Incidents table, so it appears someone has deleted them. They are also not in the 'Deleted Records' module, so I'm not sure where else to look. Is there another log of activity sompeplace?

[Pradeep Sharma]

Hi Ronald,

The below link should answer your question.

Restoring Deleted Records - ServiceNow Wiki

[rlegters]

Thanks for the quick reply. As I mentioned in my question, though, I've looked in the 'Deleted Records' table, and these Incidents aren't there. I'm wondering if there is some other activity log or audit log that might help me find where they went.

[Pradeep Sharma]

Hi Ronald,

Thanks for the update. "Deleted Records" is the only place from where you can restore the record.

[Uncle Rob]

So, if they don't appear in the Deleted Records table my first two reactions would be...

1)   Double check my incident query

2)   Double check my deleted records query.

Besides that you could check if the Incident table (or worse, task) has been marked with no_audit_delete=true attribute. That would be hella bad news.

It *is* possible that someone with admin rights deleted the deleted_record record <that was a fun sentence to write>.

Anyone else on your system other than   you with Admin rights?