[EricDD]

Hi: two folders are missing from my documents folder. did I mistakenly delete them - I don't think so. I downloaded the beta version of norton and ran unerase but did not find them. i ran fsck-y-f hoping it might repair whatever may have broken. I am very confused. Obviously, they seem to be gone. I cannot figure out what has happened at all. I installed tinker tool and made invisible files visible and also installed locator to search. nothing. now, these folders were not completely backed up which is another story in itself - I know. I can say with 95% certainty that I did not delete these folders by mistake. I am hoping that somebody may have some advice to recover them. I am running 10.1.2 with a separate 9.2.2 partition on a lombard 400. Thank you very much. Eric

[chris v]

Originally posted by EricDD:
<STRONG>Hi: two folders are missing from my documents folder. did I mistakenly delete them - I don't think so. I downloaded the beta version of norton and ran unerase but did not find them. i ran fsck-y-f hoping it might repair whatever may have broken. I am very confused. Obviously, they seem to be gone. I cannot figure out what has happened at all. I installed tinker tool and made invisible files visible and also installed locator to search. nothing. now, these folders were not completely backed up which is another story in itself - I know. I can say with 95% certainty that I did not delete these folders by mistake. I am hoping that somebody may have some advice to recover them. I am running 10.1.2 with a separate 9.2.2 partition on a lombard 400. Thank you very much. Eric</STRONG>

First, I'd stay away from the Norton beta. A few folks have had serious probs with it, IIRC. Your best bet is Disk Warrior, though you have to boot from OS 9 to run it.

CV

[dbhill]

Disappearing files or folders is symptomatic of file system problems. The best way to restore file system integrity is with DiskWarrior; as chris v has recommended above. Start from the CD or from OS 9.

~Dennis

[EricDD]

thank you. I will run disc warrior from my 9 partition. hopefully it will help. when I ran norton I only ran the file recovery - I did not try to diaganose or repair anything as I also had read about problems with it - plus, it's only in beta form so it did not seem like a smart thing to do.

Should I run disc warrior prior to trying to recover anything - ie using tech tool pro. I also just borrowed an app called data rescue 3.0 which is in beta form - never heard of it before. thanks Eric

[chris v]

Definitely Disk Warrior, first, before things have a chance to get any more messed up. It sure would be nice to have a feature like Tech Tool's trash cache in OS X, though, so even if you did just delete it by mistake, you could still recover files. Sure saved my dumb ass more than once in OS 9. Now, I always look over what files are in the trash before I delete, just 'cause I'm so scatter-brained.

CV

[EricDD]

hi: i ran disc warrior from my 9 partition. i then ran tech tool pro file recover which found nothing.

i've been trying to recreate what happened and what i remember is that i had a bad freeze trying to put it to sleep the other day. and powerbook g3's are prone to freezes at sleep it seems. the interesting thing is that i had a documents icon in my finder toolbar. after this freeze i now realize it is gone so something obviously happened. also had put my documents folder in the dock and that is gone. but makes no sense that only two folders disappeared from the documents folder. does this shed any further light or help at all. Eric

[Spike Engineering]

Same thing happened to me in the last couple days. Diskwarrior and Techtool wasn't able to find any lost files. I have a new iBook that isn't even one month old. It has 640mb ram.

Here's what happened and let me know if you think anything is suspicious or if it's all coincidental.

Monday, all my files were intact in my Documents folder in my user directory.

Tuesday, I imported 1.4 gb of DV files from an external firewire disk to make an iMovie. All those files were stored in the Movies folder. Afte not the regular trash.

Since I wasn't using MS Office X test drive, I ran the "uninstaller" on Wednesday. It mentioned that any files saved in the Office X folder would be deleted. I didn't care because all my files (a lot of stuff) are only located in the Document folder in my user directory. I noticed that the uninstaller moved the Office X test drive folder to the trash. I didn't empty the trash.

That evening, I needed to input some data into a Filemaker file located in the documents folder. I got a few emails and was distracted and never got around to it inputing the data.

Thursday, the machine apparently hung while connected to the internet. Everything got real sluggish and I couldn't force quit anything because I wasn't able to successfully launch Process Viewer. It just bounced and bounced....I also wasn't able to shutdown or restart. I left my desk for about 10 minutes and came back. The icons were still bouncing and the cd was still spinning. So, after waiting again for a few minutes, I did a hard boot (ctrl-cmd-power).

Thursday night, I noticed that two icons on the dock had question marks. It was the Documents icon and the Favorites icon. Hmmm.

Then I opened the Documents folder and saw three items: an iTunes folder, one text file I created on Tuesday using TextEdit and the Microsoft User Data folder, which never existed in this folder. Hmmm.
What happened to the other 47 items, about 176 mb of data?

Booting off the OS9 CD, I ran Techtool Pro and scavanged the hard drive. Although it found a handful of files that I could recover, none were the files I lost. So, I ran Disk Warrior. It found a few problems and repaired them. Still, no file recovery.

Bizarre. I didn't loose any other data other than my files and folders in the Documents folder in my user directory.

Since I have a DSL connection with a static IP address, I ran a port scan and found port 1033 open. I checked some security sites and found the NetSpy, a trojan horse, uses that port. But, I can't find any other info on it. I don't even know if it runs on anything other than Windows. It's a long shot, but it seems too weird for just specific files to be missing.

Hopefully, I haven't been hacked and the only thing that happened was a coincidental loss of data. Yet, I've been using Macs since mid 1984 and have never lost data in this manner. In fact I never have lost data. Plus, this is the one time that I don't have a current backup (3 weeks old) and I lost revisions I made to several files, although only one of the files was important. At least I have a hard copy showing 1/2 of the revisions.

Any unix help out there? I learn quick. Can I check any logs to look for anything suspicious.

Thanks in advance,

Spike

[ 02-17-2002: Message edited by: Spike Engineering ]

[EricDD]

spike: interesting. and you made me remember that I also had a question mark in my dock where my documents folder was. which makes no sense as the document folder itself is intact but for the two missing folders.

I still use dial up so find it hard to believe that I was hacked if not online 24/7 as with dsl or cable.

strange huh. I've also been using mac since 84 and have never had anything like this occur.

since I switched to X i have not been using any virus software: had used virex in 9.

I did run disk warrior which found a lot of fragmentation. tech tool, like for you, found a lot of files to recover, but not the two folders that I was looking for.

Besides finding my missing data, which I don't hold out much hope for, I would like to know what happened.

Do you think this sounds like a virus/trojan horse? Eric

[Spike Engineering]

Originally posted by EricDD:
<STRONG>...Do you think this sounds like a virus/trojan horse? Eric</STRONG>

The only reason why I'm suspicious of a trojan horse is because it was too bizarre to loose just the files in the documents folder (plus the open port on a machine with a static IP address). Nothing was missing in the Movies, Pictures, Sites, or the rest. Who knows, maybe someone will discover a virus or trojan horse hidden in Microsoft's Office X test drive cd.

Spike

[ 02-17-2002: Message edited by: Spike Engineering ]

[Spike Engineering]

I found more info on the open port. It's only bound to my machine. That's good.

[ 02-18-2002: Message edited by: Spike Engineering ]