[QuadG5Man]

My friend was cruising the internet as usual on his G5 1.6 with 1 gig of ram. OS 10.3.5.

He was using Acquisition for most noble causes surely, when he went into his music folder in his home, and before his eyes a windows media file that he had downloaded from Acquisition disappeared, along with, to his dismay, every single movie, jpeg, and song file he had ever downloaded; around 40-50 gigs of goodiness he had 'collected'.

He points all his acquisition downloads into the 'music' folder, where he then sorts them into their respective places, notably, 'pictures', 'movies', and into iTunes library.

All his bookmarks in Safari have also vannished, and we're pretty sure the missing data is gone, because the hard drive says it has almost all its space available now.

We're not sure what to make of this, and find it bizarre. The PowerMac G5 runs fine.

Could this be some kinda hack or virus or something. It sounds like something that would happen on a pc. We're at a loss. Where's that pesky OS 9 when you need it?

????????

[Person Man]

While I can't say for sure what caused this, hopefully your friend will learn to keep a backup from now on.

[reader50]

It wasn't a windoze media file. It was an AppleScript or Application with a custom icon to look like a media file. When launched, it executes a command to delete every file it has permission to delete - ie, all user-owned files.

You might want to leave your downloads folder in List mode, so you can verify that it is a file rather than an application or other item.

An undelete utility that scavenges files from disk may be able to recover many of the lost files. It has a better chance if the files are in subfolders, and if you do not use the HD after the deletions. TechTool Pro can scavenge the volume for files, so can Data Rescue. Norton used to be able to undelete too.

[oscar]

what was the last file your friend tried to open?

[bighead]

Programs like LimeWire and Acquisition hose your directory structures nicely. There's a good chance that to recover the ill-gotten files you'll have to run something like DiskWarrior to hopefully reconstruct a directory. Then copy the files to another volume, format the hard disk and start from scratch.

Continued use of things like Acquisition will cause things to disappear, including system files that will prevent the unit from booting. I deal with it all of the time. It's always college students with their final project that disappeared because of LimeWire (and they blame it on Apple...)

Don't believe me? Boot from your drive in single user mode, run 'fsck -fy' and tell me what you see. Chances are good you'll see invalid b-tree nodes and overlapped extents.

I always zero drives after this, but it's not usually necessary.

[QuadG5Man]

Agreed on all counts.

The culprit indeed may have been a small installer file he opened. The file claimed to be a full software install, but was only 50 k in size. When it launched he said the computer acted noticeably strained, such as being locked up, and he had to force quit out of the 'installer' to get anywhere.

Lesson learned the hard way, ouch. Use caution while 'file sharing' folks.

I've never used file recovery software before because it sounds like magic to me.
If 50 gigs are missing, how can they just be formulated again, like a liquid Terminator
oozing back together after enduring the shock and awe attack of the military, or in this case a disguised applescript file.

What kind of results could he expect? Can someone shed a little light down this corridor, inquiring mac minds want to know.


My friend was having trouble getting an account on macnn. Hopefully he'll chime in here.

Fortunately for him, at least his music collection is intact, due to BACking uP!

[Detrius]

Originally posted by bighead:
...

Don't believe me? Boot from your drive in single user mode, run 'fsck -fy' and tell me what you see. Chances are good you'll see invalid b-tree nodes and overlapped extents.

I always zero drives after this, but it's not usually necessary.

If zeroing the drive makes a difference, you need a new drive. Zeroing the drive will do a basic attempt at ensuring that files can't be recovered; however, it also maps out bad blocks. Therefore, if zeroing the drive makes a difference, you should be buying a new drive. Instead of just blindly zeroing drives, you should be running TTP4's surface scan. Or, if the machine will boot into OS 9, you can use Drive Setup's surface scan. Don't just blindly zero the drive to fix problems. It's ignorant and irresponsible.

[Detrius]

Originally posted by QuadG5Man:
...

I've never used file recovery software before because it sounds like magic to me.
If 50 gigs are missing, how can they just be formulated again, like a liquid Terminator
oozing back together after enduring the shock and awe attack of the military, or in this case a disguised applescript file.

What kind of results could he expect? Can someone shed a little light down this corridor, inquiring mac minds want to know.

...

This is why the detail about NOT USING the machine is important. The only thing that deleting files does is remove the reference in the directory structure. The data is still there. However, in creating or modifying existing files, the data could/will be overwritten, as it is officially "free space." It's not magic. Magic would be undeleting the hand written term paper you lit on fire. This is more like *remembering* where you need to look on the chalkboard to find the information--before it has been cleaned and overwritten.

[chris v]

Originally posted by QuadG5Man:
Agreed on all counts.

The culprit indeed may have been a small installer file he opened. The file claimed to be a full software install, but was only 50 k in size. When it launched he said the computer acted noticeably strained, such as being locked up, and he had to force quit out of the 'installer' to get anywhere.

Wasn't there a bogus MS Office installer trojan going around the file-sharing networks? Sounds like that to me. Do a search in the OS X forum.

[oscar]

http://www.intego.com/news/pr42.html

[danbrew]

That's pretty good - installing what you think is a hot copy of an app will kill your drive. wow - makes you want to think twice about what you install. kind of like dating.

yeah, ah, you generally should not run installer scripts unless you know exactly what the hell you're doing or unless you've completed backed up your drive and don't mind screwing around for 1/2 day recovering the machine.

[chris v]

Originally posted by danbrew:
That's pretty good - installing what you think is a hot copy of an app will kill your drive. wow - makes you want to think twice about what you install. kind of like dating.

yeah, ah, you generally should not run installer scripts unless you know exactly what the hell you're doing or unless you've completed backed up your drive and don't mind screwing around for 1/2 day recovering the machine.

???
I can wipe a drive and clone from a backup in about 30 minutes, but you're right-- it's Russian Roulette.

[danbrew]

Originally posted by chris v:
???
I can wipe a drive and clone from a backup in about 30 minutes, but you're right-- it's Russian Roulette.

Very true, but guys like you and me aren't going to be running some unknown script. The guys who have no clue about cloning drives fwtdm, disk images, etc., etc., etc., are the ones who will get their drives trashed.

I've always said that if you're gonna do **** like that you need to have a spare machine - one for work stuff and one for ****ing around with stuff that you completely don't mind losing. Way too many people have one machine with a single copy of their data. Ouch.