[Neo.cmg]

I just wanted to inform you all with no preconceived notion that this will affect anyone else, but I updated to 10.3.8 on my dual 1Ghz PowerMac G4 last night and upon restarting the machine my entire user directory was replaced with one of the same name; however, all the directories were emptied of their files. Approximately 24 GB of user data: iTMS music, pictures, financial and tax information, graduate papers and work, application preferences, mail, software license numbers, etc. gone in one short swoop.

It's my fault for not keeping backups of this stuff, and my machine is currently with a certified apple technician to see if it can be restored. Hopefully things will be alright. I actually have had this happen with the last update, but immediately after restarting a 2nd time everything was back to normal. However, this time I wasn't so fortunate. I'm not sure if file vault is the culprit, but the stuff has got to be there somewhere just browsing the drive using Norton's UnErase utility brought up files that had been erased over 2 years ago...

Anyway, I just wanted to let you all know that it may or may not be an issue.

Neo.cmg

[TETENAL]

This is most definitely a FileVault problem. Did you look into the FileVault disk image? I bet everything is still inside there.

[Neo.cmg]

Originally posted by TETENAL:
This is most definitely a FileVault problem. Did you look into the FileVault disk image? I bet everything is still inside there.

I went through the filesystem in my shell, and was unable to locate anything itself. Furthermore the disk space went from 26GB of available space to 50GB of available space leading me to believe that it was overwritten with this new user folder. Any suggestions as to where the filevault disk image is stored?

In reflecting, I did notice an extra Desktop directory appearing in save dialog windows that had a generic folder icon. Investigating this uncovered a hidden directory with the same name as my user directory (e.g. .<username>) I didn't create that directory, and the file tree contained no data at all. I removed it, but still had all my data that I could interact with even after I removed it. This did fix the duplicate Desktop directory I was encountering. Later, I updated OS X to 10.3.8 and all was lost.

Neo.cmg

[turtle777]

Not to be cynical, but we all can learn two lessons:

1) ALWAYS HAVE BACKUPS BEFORE UPDATING

2) ALWAYS HAVE BACKUPS WHEN USING FILE VAULT

-t

[Neo.cmg]

Originally posted by turtle777:
Not to be cynical, but we all can learn two lessons:

1) ALWAYS HAVE BACKUPS BEFORE UPDATING

2) ALWAYS HAVE BACKUPS WHEN USING FILE VAULT

-t

You're absoulutely right, and I should have backed up this stuff. I place no blame on anyone but myself, nor do I have any need for FileVault really other than it was a feature and I chose to use it. You can claim how dumb it was, and I'll be the first to acknowledge that. Though, I still think it is important to let others who might be in the same situation think about it before updating to 10.3.8 as that may have been something that triggered what happened to my now absent files.

[turtle777]

Originally posted by Neo.cmg:
nor do I have any need for FileVault really other than it was a feature and I chose to use it.

Unfortunately, File Vault seems to continue to cause problems.

I dumped it right from the start, when it would mess up my prefs all the time. I decided that data loss would be worse than someone prying on my data...

-t

[TETENAL]

Originally posted by Neo.cmg:
I went through the filesystem in my shell, and was unable to locate anything itself. Furthermore the disk space went from 26GB of available space to 50GB of available space leading me to believe that it was overwritten with this new user folder. Any suggestions as to where the filevault disk image is stored?

The FileVault disk image should be in /Users/.neo/neo.sparseimage (assuming neo is your user name). When FileVault accidently got disabled by the update or an unrelated error, this disk image should still include your complete home folder. It can be mounted like any other disk image (just requires the FileVault password).

[Neo.cmg]

Originally posted by TETENAL:
The FileVault disk image should be in /Users/.neo/neo.sparseimage (assuming neo is your user name). When FileVault accidently got disabled by the update or an unrelated error, this disk image should still include your complete home folder. It can be mounted like any other disk image (just requires the FileVault password).

Okay, you can add my ignorance of the inner-workings of FileVault into the mix as causes for this incident. I went in my shell and rm -rf the /Users/.neo directory as it appeared to me to be an unused and empty file tree and was creating an unwanted duplicate Desktop directory to appear in my save dialog windows. So, having said that, would you say that doing this in effect was similar to just trashing my /Users/neo/ directory? I can't readily access /Users/.neo/neo.sparseimage any longer to mount it. If that is the case, then seeking data recovery assistance as I am now would appear to me to be the right course of action.

Neo.cmg

[turtle777]

At this point, I wish there was some easy way to fix it, but it seems to me that you are SOL.

There mgith be a way to recover the deleted file vault file with some special software, but then again, since it is one huge compressed and encypted file, it has to be 100% restored to get ANY data back from it.

-t

[CatOne]

Originally posted by Neo.cmg:
Okay, you can add my ignorance of the inner-workings of FileVault into the mix as causes for this incident. I went in my shell and rm -rf the /Users/.neo directory as it appeared to me to be an unused and empty file tree and was creating an unwanted duplicate Desktop directory to appear in my save dialog windows. So, having said that, would you say that doing this in effect was similar to just trashing my /Users/neo/ directory? I can't readily access /Users/.neo/neo.sparseimage any longer to mount it. If that is the case, then seeking data recovery assistance as I am now would appear to me to be the right course of action.

Neo.cmg

You WHAT?!

So you're saying that you noticed the data loss (i.e. the new blank home directory), and then you rooted around and found a 26 GB disk image, and did an 'rm -rf' on it because you didn't know what it was?

OMG. Sorry dude, you just did some data Darwinism :/

[Neo.cmg]

Originally posted by CatOne:
You WHAT?!

So you're saying that you noticed the data loss (i.e. the new blank home directory), and then you rooted around and found a 26 GB disk image, and did an 'rm -rf' on it because you didn't know what it was?

OMG. Sorry dude, you just did some data Darwinism :/

I think you're misunderstanding me. I removed the hidden user directory /Users/.neo/ after looking in each directory contained within for an unrelated issue that seemed to be the culprit behind duplicating a Desktop directory in my save file dialog windows. The /Users/.neo/ directory was just an empty tree of a generic user directory. I removed this--there was no root permissions needed to do so. Upon updating and restarting is whereupon I noticed the 24 GB of free disk space and a fresh user directory tree created in /Users/. That much did fix the problem I was having, but I didn't realize or understand what I was doing in the process. Call me stupid, and have a good laugh. I'm sure you'll enjoy it.

I would think that if the FileVault image could be found, all it would need is my user password to unencrypt, uncompress, and mount. Perhaps not, and I'll have to spend some time restoring as much as I can.

Neo.cmg

[TETENAL]

Originally posted by Neo.cmg:
I removed the hidden user directory /Users/.neo/ after looking in each directory contained within for an unrelated issue that seemed to be the culprit behind duplicating a Desktop directory in my save file dialog windows. The /Users/.neo/ directory was just an empty tree of a generic user directory. I removed this--there was no root permissions needed to do so. Upon updating and restarting is whereupon I noticed the 24 GB of free disk space and a fresh user directory tree created in /Users/.

It seems you yourself deleted the FileVault disk image – which is your home folder. This doesn't look like a 10.3.8 or FileVault problem to me.

You're only hope is data recovery software or a professional data recovery service.

[CharlesS]

Yep, your data is gone.

Here's an excerpt from the man page for unlink(), the function that gets called when you ask to delete a file:

The unlink() function removes the link named by path from its directory and decrements the link count of the file which was referenced by the link. If that decrement reduces the link count of the file to zero, and no process has the file open, then all resources associated with the file are reclaimed. If one or more process have the file open when the last link is removed, the link is removed, but the removal of the file is delayed until all references to it have been closed.

Basically, what happened was that when you deleted the disk image, the OS removed the hard link to the file, but didn't actually delete the file yet since it noticed that an application had it open (i.e. the disk image mounting system). Therefore, the OS decides that it'll wait until the program that's using the file closes it before it'll actually delete it, which is why you didn't see your disk space go down yet. However, as soon as you rebooted, and the system let go of the file momentarily...

[forkies]

o m g why? sorry, man

[Partisan01]

Originally posted by TETENAL:
It seems you yourself deleted the FileVault disk image – which is your home folder. This doesn't look like a 10.3.8 or FileVault problem to me.

You're only hope is data recovery software or a professional data recovery service.

You are out of luck for an easy fix, but not totally out of luck. If you do not do anything on your computer you might be alright. REPEAT: DO NOT DO ANYTHING, SHUT DOWN AND REMOVE YOUR HARD DRIVE.

You can purchase software called EnCase, our company has it, I have no idea how much it cost, I would guess in the thousands of dollars range, but it can recover anything from a hard drive, even a hard drive that's been formatted and written over.

Second option call a data recovery professional like the above poster mentioned. My boss's HD died, he had no backups, so the company sent out his laptop HD to a recovery professional. They sent him back a USB external HD with all of his information on it. He keeps backups now.

Lesson learned: MAKE BACKUPS. I learned my lesson when I was using Linux a few years back rm -rf 'ed my home dir, it sucked, but now I am very very careful before using that command.

If the data is valuable then you'll have no problem paying someone to recover it, if not then don't make the same mistake again.

[turtle777]

Originally posted by Partisan01:
You are out of luck for an easy fix, but not totally out of luck. If you do not do anything on your computer you might be alright. REPEAT: DO NOT DO ANYTHING, SHUT DOWN AND REMOVE YOUR HARD DRIVE.

Actually, it is very unlikely that this will work.

Here is why: after rebooting, OS X uses part of the HD space as a scratch disk. If this scratch disk used only 1 bit of the old file and deleted it, there is NO way to restore the file vault file. Since the file vault is one big compressed and encrypted file, you won't get it decrypted if a part is missing.
(If I am toally wrong here, then someone correct me please.)

-t

[Big Mac]

I would say you're probably right, turtle, but it may just still be intact provided that the OP had a lot of free space on his drive, a sufficient amount of RAM, and that he did not do anything except for restarting. It is a long shot but possibly recoverable by a professional service.