Mysterious Image File Names Change

Joined
Jan 31, 2020
Messages
2
Reaction score
0
Points
1
My friend has a MacBook Air, about 2 years old. She called me to report that the names on her image files had been changed without her knowledge or input. Through some investigation, I found that on May 21, 2019, beginning at about noon, something proceeded to change the file names on all her image files (in multiple folders) from the descriptive file name she had created for each file to a long string of letters and numbers. There is structure to the new file names, but no meaning that I can determine. The process ran from about noon on that day, until nearly midnight, as can be seen from the modified by timestamp on the folders.

I checked the image file metadata for a couple of instances, and found nothing unusual. I also downloaded, installed, and ran Malwarebytes free malware scanner. It gave the system a clean, no malware found, report.

My friend backs up to an external HDD by copying folders from the computer to the eHDD. Of course, in the process, she has over-written the original files with the renamed copies.

Do any of you out there have suggestions for:
1. any potential causes for this behavior.
2. any way to recover the original file names.

TIA for any insights.
 
Joined
Jan 1, 2009
Messages
15,452
Reaction score
3,808
Points
113
Location
Winchester, VA
Your Mac's Specs
MBP 16" 2023 (M3 Pro), iPhone 15 Pro, plus ATVs, AWatch, MacMinis (multiple)
Well, it's been over eight months, so it is probably too late to ask her what she was doing that day, which normally would be the first question. Did she install anything that day? Did she add anything to the system? Does she use Photos and how does she do that (import or use external files)? What is the "structure" you see to the file names? Date/time, sequential, what? Can you get a screenshot of a few of these in Finder in the list view so we can see the patterns to analyze? Do the console logs from that far back still exist? If so, is there anything it the logs? Does she have, and sync to, an iPhone or iPad through iCloud? Does she sync to a non-Apple device? Did she make any changes in how she uses iCloud that day? Does she use any other syncing service for images?

Malwarebytes is OK, but DetectX Swift is a bit better. You can try that, but I doubt it is malware.

I seriously doubt there is a way to get the original names back unless she had been making Time Machine backups. Just copying is easy, but not really able to recover from this kind of unwanted change.
 
OP
D
Joined
Jan 31, 2020
Messages
2
Reaction score
0
Points
1
Well, it's been over eight months, so it is probably too late to ask her what she was doing that day, which normally would be the first question. Did she install anything that day? Did she add anything to the system? Does she use Photos and how does she do that (import or use external files)? What is the "structure" you see to the file names? Date/time, sequential, what? Can you get a screenshot of a few of these in Finder in the list view so we can see the patterns to analyze? Do the console logs from that far back still exist? If so, is there anything it the logs? Does she have, and sync to, an iPhone or iPad through iCloud? Does she sync to a non-Apple device? Did she make any changes in how she uses iCloud that day? Does she use any other syncing service for images?

Malwarebytes is OK, but DetectX Swift is a bit better. You can try that, but I doubt it is malware.

I seriously doubt there is a way to get the original names back unless she had been making Time Machine backups. Just copying is easy, but not really able to recover from this kind of unwanted change.

Hello Jake, thanks for your quick reply.

I asked her if she remembered any activity on that day; she replied that she hadn't been on the computer at all on the 21st. So "No" to the next several questions.

I'm arranging to get a folder's worth of file names and related metadata, which should show up any patterns. Also will get a Finder screenshot or two.

I checked the console logs, AFAICT, they go back only a month or so. I'm familiar with Linux log-rotate, and check the .gz files, as well. She doesn't use iCloud, and I'll check further about sync with other devices. Also, will check out DetectX Swift. Thanks for the suggestion. I've suggested to her that as she should get another external HDD, and as she renames the files in each of the folders, she should attach the new EHDD, copy the folder to it, check that the file names are as they should be, and then disconnect the EHDD until she's ready to copy over the next folder. There are a lot of files and folders (I will get a count). More info to come after I get another remote session with her.

At this point, we are much more interested in a possible cause or mechanism for the renaming than in recovering the original file names; we're pretty sure that horse is already left the barn. Thanks.
 

Shop Amazon


Shop for your Apple, Mac, iPhone and other computer products on Amazon.
We are a participant in the Amazon Services LLC Associates Program, an affiliate program designed to provide a means for us to earn fees by linking to Amazon and affiliated sites.
Top