Results 1 to 3 of 3
  1. #1
    Mysterious Image File Names Change
    My friend has a MacBook Air, about 2 years old. She called me to report that the names on her image files had been changed without her knowledge or input. Through some investigation, I found that on May 21, 2019, beginning at about noon, something proceeded to change the file names on all her image files (in multiple folders) from the descriptive file name she had created for each file to a long string of letters and numbers. There is structure to the new file names, but no meaning that I can determine. The process ran from about noon on that day, until nearly midnight, as can be seen from the modified by timestamp on the folders.

    I checked the image file metadata for a couple of instances, and found nothing unusual. I also downloaded, installed, and ran Malwarebytes free malware scanner. It gave the system a clean, no malware found, report.

    My friend backs up to an external HDD by copying folders from the computer to the eHDD. Of course, in the process, she has over-written the original files with the renamed copies.

    Do any of you out there have suggestions for:
    1. any potential causes for this behavior.
    2. any way to recover the original file names.

    TIA for any insights.

  2. #2
    Mysterious Image File Names Change
    MacInWin's Avatar
    Member Since
    Jan 01, 2009
    Location
    Winchester, VA
    Posts
    7,883
    Your Mac's Specs
    MBP 15" Mid 2015, iPhone 11 Pro, an iMac, plus ATVs, AWatch, MacMini
    Rep Power
    29
    Well, it's been over eight months, so it is probably too late to ask her what she was doing that day, which normally would be the first question. Did she install anything that day? Did she add anything to the system? Does she use Photos and how does she do that (import or use external files)? What is the "structure" you see to the file names? Date/time, sequential, what? Can you get a screenshot of a few of these in Finder in the list view so we can see the patterns to analyze? Do the console logs from that far back still exist? If so, is there anything it the logs? Does she have, and sync to, an iPhone or iPad through iCloud? Does she sync to a non-Apple device? Did she make any changes in how she uses iCloud that day? Does she use any other syncing service for images?

    Malwarebytes is OK, but DetectX Swift is a bit better. You can try that, but I doubt it is malware.

    I seriously doubt there is a way to get the original names back unless she had been making Time Machine backups. Just copying is easy, but not really able to recover from this kind of unwanted change.
    Jake

  3. #3
    Quote Originally Posted by MacInWin View Post
    Well, it's been over eight months, so it is probably too late to ask her what she was doing that day, which normally would be the first question. Did she install anything that day? Did she add anything to the system? Does she use Photos and how does she do that (import or use external files)? What is the "structure" you see to the file names? Date/time, sequential, what? Can you get a screenshot of a few of these in Finder in the list view so we can see the patterns to analyze? Do the console logs from that far back still exist? If so, is there anything it the logs? Does she have, and sync to, an iPhone or iPad through iCloud? Does she sync to a non-Apple device? Did she make any changes in how she uses iCloud that day? Does she use any other syncing service for images?

    Malwarebytes is OK, but DetectX Swift is a bit better. You can try that, but I doubt it is malware.

    I seriously doubt there is a way to get the original names back unless she had been making Time Machine backups. Just copying is easy, but not really able to recover from this kind of unwanted change.
    Hello Jake, thanks for your quick reply.

    I asked her if she remembered any activity on that day; she replied that she hadn't been on the computer at all on the 21st. So "No" to the next several questions.

    I'm arranging to get a folder's worth of file names and related metadata, which should show up any patterns. Also will get a Finder screenshot or two.

    I checked the console logs, AFAICT, they go back only a month or so. I'm familiar with Linux log-rotate, and check the .gz files, as well. She doesn't use iCloud, and I'll check further about sync with other devices. Also, will check out DetectX Swift. Thanks for the suggestion. I've suggested to her that as she should get another external HDD, and as she renames the files in each of the folders, she should attach the new EHDD, copy the folder to it, check that the file names are as they should be, and then disconnect the EHDD until she's ready to copy over the next folder. There are a lot of files and folders (I will get a count). More info to come after I get another remote session with her.

    At this point, we are much more interested in a possible cause or mechanism for the renaming than in recovering the original file names; we're pretty sure that horse is already left the barn. Thanks.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. Cannot change file names in Finder
    By rhythmguy in forum macOS - Operating System
    Replies: 18
    Last Post: 11-24-2017, 06:36 PM
  2. iTunes Song names to File names
    By Brooklynguy in forum Music, Audio, and Podcasting
    Replies: 1
    Last Post: 12-25-2016, 08:21 PM
  3. New Blog: The Mysterious File:/// Bug
    By MF Blog Bot in forum Apple Rumors and Reports
    Replies: 4
    Last Post: 03-10-2013, 11:33 AM
  4. Mysterious file on desktop
    By WhiskeyJack in forum macOS - Operating System
    Replies: 7
    Last Post: 12-18-2011, 08:16 PM
  5. Any way to change file names in pages?
    By Drjones in forum iOS and Apps
    Replies: 0
    Last Post: 05-12-2010, 10:52 PM

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •