New To Mac-Forums?

Welcome to our community! Join the discussion today by registering your FREE account. If you have any problems with the registration process, please contact us!

Get your questions answered by community gurus Advice and insight from world-class Apple enthusiasts Exclusive access to members-only contests, giveaways and deals

Join today!

 
Start a Discussion
 

Mac-Forums Brief

Subscribe to Mac-Forums Brief to receive special offers from Mac-Forums partners and sponsors

Join the conversation RSS
OS X - Operating System General OS operation information and support

What Purged Files on My Wife's Hard Drive?


Post Reply New Thread Subscribe

 
Thread Tools
noob_for_life

 
Member Since: Aug 16, 2013
Posts: 4
noob_for_life is on a distinguished road

noob_for_life is offline
I'm stumped. My wife's Documents folder was purged and her Desktop folder, almost so and in a strange way. Her Firefox bookmarks also were deleted. At first, I thought this was some kind of trojan horse. But, I can't find anyone else with a similar problem. If anyone has any advice, please help. Here is what I know:

1) She is in a vacation home in a small town with our kids and her extended family.
2) She had mistakenly connected to an open wireless network and not the password protected one that came with the house.
3) Her firewall was off. But, she was set up only for File Sharing and Screen Sharing
4) The Console shows no record of anyone connecting using either of those methods.
5) She had files in her Trash prior to the incident. Those files remain in her trash. The files removed from Desktop and Documents are not.
6) Our son had been using the computer earlier with his cousin. They had done some design work in Photoshop, turned on AirDrop, and installed some Minecraft mod files.
7) We ran ClamXAV on the drive. It only showed viruses attached to spamming emails, stuff she would not have opened.
8) Music, Movies, Sites etc remained untouched.
9) The strangest thing of all: Her Desktop is not completely empty. Previously it was loaded up with lots of stuff. Now, two folders remain in it. Each of those folders had lots of stuff. Now they each have only one folder. Each of those had previously had lots of stuff. Now they each only have one folder. And so on. There is a hierarchy of about seven levels like this until you get to the bottom and find a few files. It's almost as if a recursive deleting routine had run on the drive and had stopped before it had finished.

Any suggestions of how to look at this?

Thanks!

Gary
QUOTE Thanks
bobtomay

 
bobtomay's Avatar
 
Member Since: Dec 22, 2006
Location: Texas, where else?
Posts: 24,990
bobtomay has a reputation beyond reputebobtomay has a reputation beyond reputebobtomay has a reputation beyond reputebobtomay has a reputation beyond reputebobtomay has a reputation beyond reputebobtomay has a reputation beyond reputebobtomay has a reputation beyond reputebobtomay has a reputation beyond reputebobtomay has a reputation beyond reputebobtomay has a reputation beyond reputebobtomay has a reputation beyond repute
Mac Specs: 15" MBP 2.33 C2D 256 4GB, MBA 13" i7 1.8, MB 2.0 2GB, Nano 4th, 3GS, iPad 1

bobtomay is offline
Sounds like she changed her home folder name?

I cannot be held responsible for the things that come out of my mouth.
In the Windows world, most everything folks don't understand is called a virus.
QUOTE Thanks
noob_for_life

 
Member Since: Aug 16, 2013
Posts: 4
noob_for_life is on a distinguished road

noob_for_life is offline
Quote:
Originally Posted by bobtomay View Post
Sounds like she changed her home folder name?
Maybe. I can check with them. It doesn't sound like the kind of thing my son (who is fairly savvy) or my wife (who doesn't mess with things) would do. And, wouldn't that have affected her music and movies, too?

This screams trojan horse to me. But, I keep hearing that I don't need to worry about that on a mac. Others have said this has to be a person's doing. But, the untouched trash and the lack of file sharing log entries says otherwise to me.

We also just discovered that her Address Book had been purged of all of its entries. I can't see a person almost purging those Desktop directories and deleting some things in her user Library (if that's how, in fact, Firefox and Address Book were affected).

Are there any things I can look for in any logs for signs of some kind of intervention.
QUOTE Thanks
chscag

 
chscag's Avatar
 
Member Since: Jan 23, 2008
Location: Fort Worth, Texas
Posts: 38,397
chscag has a reputation beyond reputechscag has a reputation beyond reputechscag has a reputation beyond reputechscag has a reputation beyond reputechscag has a reputation beyond reputechscag has a reputation beyond reputechscag has a reputation beyond reputechscag has a reputation beyond reputechscag has a reputation beyond reputechscag has a reputation beyond reputechscag has a reputation beyond repute
Mac Specs: 27" iMac i5, 3.2 GHz, iPad 3, iPhone 5c, 3 iPods, OS X Mavericks

chscag is offline
Quote:
Are there any things I can look for in any logs for signs of some kind of intervention.
Let's wait and see what her or your son's answer is about the home folder name being changed. The name may have been changed accidentally which would cause all the things that you have so far mentioned.

And it's very unlikely that it's a trojan or some form of malware.
QUOTE Thanks
noob_for_life

 
Member Since: Aug 16, 2013
Posts: 4
noob_for_life is on a distinguished road

noob_for_life is offline
Quote:
Originally Posted by chscag View Post
Let's wait and see what her or your son's answer is about the home folder name being changed. The name may have been changed accidentally which would cause all the things that you have so far mentioned.
Gotta love young teens. The response from my 14 year old and his cousin: "most likely not but maybe"

Let's say I wanted to test this happening and I didn't want to destroy my computer. Suppose I copy a large numbers of files to a dummy user ID on the computer and then, as that user, rename the home directory, and soon after name it back. Would that be both an accurate and safe test?

Any idea how long I would need to leave it with the bad name?

Naturally, I'll make sure I have a full backup before doing anything.

Thanks again!

Gary
QUOTE Thanks
bobtomay

 
bobtomay's Avatar
 
Member Since: Dec 22, 2006
Location: Texas, where else?
Posts: 24,990
bobtomay has a reputation beyond reputebobtomay has a reputation beyond reputebobtomay has a reputation beyond reputebobtomay has a reputation beyond reputebobtomay has a reputation beyond reputebobtomay has a reputation beyond reputebobtomay has a reputation beyond reputebobtomay has a reputation beyond reputebobtomay has a reputation beyond reputebobtomay has a reputation beyond reputebobtomay has a reputation beyond repute
Mac Specs: 15" MBP 2.33 C2D 256 4GB, MBA 13" i7 1.8, MB 2.0 2GB, Nano 4th, 3GS, iPad 1

bobtomay is offline
I believe you have to reboot after the name change - not sure since I've never personally tried it - but that's the report from most of those that have done it - they notice all their stuff missing after a reboot.

And gotta set those youngsters up with their own user account if they're going to be using any adults computer - a non-admin account. Learned that lesson the hard way myself many years ago.

I cannot be held responsible for the things that come out of my mouth.
In the Windows world, most everything folks don't understand is called a virus.
QUOTE Thanks
noob_for_life

 
Member Since: Aug 16, 2013
Posts: 4
noob_for_life is on a distinguished road

noob_for_life is offline
This is getting crazier. I did two things over the weekend:

1) I took an old computer and tried renaming the home directory. Two things about this:

a) I had to go through quite a dance to make this happen (create users and granting authority to the primary user's folder, that or using sudo in command line to rename). It was unlikely anyone would have done this accidentally.

b) The result wasn't quite what my wife experienced. Upon returning to the primary user's account, I had a default set of unused folders. But, the original hierarchy was still there in the Users directory, just under the new name. In my wife's case, she has lost many, but not all files. Her Documents folder was cleared. Her Desktop folder was largely, but strangely, cleared. But, her Movies and Pictures were fine. And her Library was selectively cleared (Mail untouched. Browser, Address Book and probably others reset).

Accidentally renaming the home directory was an interesting idea. But, it's looking unlikely to me now.

2) I got the computer back and ran Data Rescue 3 against it. A Quick Scan found none of the deleted files. I ran a Deep Scan and grabbed all of the few Excel files it could find (and it should have found many). None of them were the one file she and I were exchanging. So, I'm not even finding the deleted files. She had over 1/4 of the drive free before this. So, I can't imagine they were written over in this period.

She has an SSD drive. Do they deal with deleted files differently?

Thanks!

Gary
QUOTE Thanks

Post Reply New Thread Subscribe


« Display entire desktop in window? | Mac Pro not reading external drives »
Thread Tools

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off
Forum Jump

Similar Threads
Thread
Thread Starter
Forum
Replies
Last Post
Early macbook pro 2008 kernel panic, hard drive problem dahl24 Apple Notebooks 6 10-23-2012 08:56 AM
Problem Downloading Video Files on a Toshiba External Hard Drive. Fire_Phoenix Other Hardware and Peripherals 12 07-14-2012 05:49 PM
1 Hard drive for OS and 1 Hard drive for files vs RAID 0? Macintosh95 Apple Desktops 1 01-20-2012 07:36 PM
How to import .MTS files into iMovie that have been archived baz201 Movies and Video 1 01-12-2012 07:49 PM
Questions regarding post-processing work using an iMac & an external hard drive J-Villa Images, Graphic Design, and Digital Photography 3 01-06-2012 10:07 AM

All times are GMT -4. The time now is 12:04 AM.

Powered by vBulletin
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
X

Welcome to Mac-Forums.com

Create your username to jump into the discussion!

New members like you have made this community the ultimate source for your Mac since 2003!


(4 digit year)

Already a member?