Find deleted records by sys_id

There has been many times where you have been looking for a specific record and have the sys_id but cannot find any trace of it and want to check if it has been deleted.

This script will look for a sys_id in the usual places and provide you an update if it can be found.

Note: This script won't find all the deleted records, but it has been used a number of times already and been able to find where the deleted record is quickly and can determine when and who may have deleted it.

The script is below, and may be copied and pasted into your instance. Populate the sys_id and the table name. Click Run.

// Find deleted records with sys_id
// This script will look for your sys_id in tables:
// sys_audit
// sys_audit_delete
// sys_rollback_sequence
// Shadow table

// Enter in sys_id of the record
// if you know table please populate table variable as well, otherwise leave as blank.
var sys_id = '___sys_id___';
var tableName ='';

var instanceName = gs.getProperty('instance_name');
findDeletion();

function findDeletion() {

     chk_audit_delete();
     chk_rollback_seq();
     chk_audit();
     if(tableName != '')
      chk_shadow();
     gs.print('End of Search');

}

function chk_audit_delete()
{
 var chk = new GlideRecord('sys_audit_delete');
 chk.addEncodedQuery("documentkey="+sys_id);
 chk.setLimit(1);
 chk.query();

 if(chk.next())
    gs.log("Found deleted record in sys_audit_delete: https://" + instanceName + ".service-now.com/sys_audit_delete_list.do?sysparm_query=documentkey%3D" +sys_id + "\n");
 
    

} 

function chk_rollback_seq()
{
 var chk = new GlideRecord('sys_rollback_sequence');
 chk.addEncodedQuery("document_id="+sys_id);
 chk.setLimit(1);
 chk.query();

 if(chk.next())
 {
    gs.log("Found deleted record in sys_rollback_sequence: https://" + instanceName + ".service-now.com/sys_rollback_sequence_list.do?sysparm_query=document_id%3D" +sys_id + "\n");
       
    gs.log("This was found to be related to rollback sequence:" + chk.context.getDisplayValue())
 }
 

}

function chk_audit()
{
 var chk = new GlideRecord('sys_audit');
 chk.addEncodedQuery("documentkey="+sys_id+"^fieldname=DELETED");
 chk.setLimit(1);
 chk.query();

 if(chk.next())
    gs.log("Found deleted record in sys_audit: https://" + instanceName + ".service-now.com/sys_audit_list.do?sysparm_query=documentkey%3D" +sys_id + "%5Efieldname%3DDELETED" + "\n");
 

}

function chk_shadow()
{
    var tablechk = new GlideRecord('sys_storage_alias')
    tablechk.addEncodedQuery("table_name="+tableName);
    tablechk.setLimit(1);
    tablechk.query();

    if(tablechk.next())
    {

  var chk = new GlideRecord('sh$'+tablechk.storage_table_name);
  chk.addEncodedQuery("sys_id="+sys_id);
  chk.setLimit(1);
  chk.query();

  if(chk.next())
     gs.log("Found deleted record in shadowtable: https://" + instanceName + ".service-now.com/sh$"+tablechk.storage_table_name+"_list.do?sysparm_query=sys_id%3D" +sys_id + "\n");
  
    }

}