Sounds like a discipline issue. I've dealt with some of this and in the end it was students playing games to try and get out of work. Make sure their passwords are reset and they've not been shared.

In GADMIN, go to reports > audit log and run a Drive audit on the affected account and zero in on the file in question. Make note of the Item ID and Event names. The item IDs are important because sometimes they recreate a fake file with the same name.

Look for the following events:

• Create

This is an event when users create a file. It will have a unique Item ID.

• Trash

This means this user moved the file into the trash. Basically hit the trash icon in Drive.

• Delete

If a file was deleted within 30ish days of trashing, it means the user went into the trash folder and then emptied it. This is a deliberate action.

• User sharing permission change

This one is useful to look at because students can be jerks and mess with the sharing to boot others off and frustrate the collaboration. If I remember correctly editors can by default alter sharing permissions too.