main user account ERASED as mistaken for guest account

Question

Level 1

0 points

main user account ERASED as mistaken for guest account

Excuse my bad english, as i'm from germany and still under shock:

my complete data in my user account was erased at 18:09 when i logged out from leopard to reboot. before i installed and worked about 6 hours on that computer.

* the last thing i did was installing the actual vpn client from cisco as it is needed to access our vpn from travel.
* before i copied some data to a firewire drive (not used as time-machine)
* i enabled guest access earlier this day.
* i have a basic time machine backup, but have lost about 5 days of work and mails as it seems permanenetly.

i got a warning before logging out, checked that i WAS NOT guest and started logging out again. this took longer than usual - but i thought "this cant happen - apple wouldn't be so ...". seems i was wrong. the funny thing is that i use macs for about six years and guess that i was confident that this wouldn't happen because till now nothing really bad happened.

i can't provide any additional specific information. the leopard installation was made from scratch, the software attaching deeper to the os on this system is little snitch, parallels and the latest vpn software from cisco. i would consider this no problem.

i found at least one more occurence of this desaster: http://discussions.apple.com/thread.jspa?messageID=5789519&#5789519.

i just can give out the warning that if you see the popup the guest accounts triggers about erasing the files and you know you are not logged in as guest CLONE YOUR COMPLETE USERFOLDER IMMEDIATLY.

please spare me with the "don't use any 10.x.0 sofware in production" or "always make backup" because that would be insult to injury. if anyone is couragous/bold enough, he or she might try out what is going on with the guest account handling. i'm done with that.

Macbook Pro, Mac OS X (10.5)

Posted on Nov 13, 2007 11:28 AM

Reply

Answer 1

sheldonc

Level 1

26 points

Nov 13, 2007 11:47 AM in response to ecolot

Wow, ecolot, that sounds pretty bad. Thanks for the tip.

Did you report this to Apple?

I'm also surprised that Time Machine did not save any info for your home directory for 5 days. The post you cite says she was fortunate to be able to recover her lost files immediately.

Keep us posted if you find out the cause1

Reply

Answer 2

ecolot Author

Level 1

0 points

Nov 13, 2007 12:30 PM in response to sheldonc

thank you for your reply.

i've been out with the laptop for five and a half days, and so there wasn't any backup of that time. call it bad luck.

the summ of all the coincidental factors (is that correct english?) is that what hits me. i enabled guest access by pure "toying". i considerd installing vpn safe after reading that the latest vpn software from cisco works if installed fresh - and maybe even that isn't related!

but whats really nagging me is the warning that i read but didn't understand: i got the guest popup, checked that i wasn't guest and logged out, because i trusted the system.

it' feels ike that time someone stole my purse in a packed subway: since then i always check it two or three times even if it is totally safe in side my coat, pocked zipped, coat zipped.

i now believe that the system can erase your user account by mistaking it for the guest account when you log out. if this can happen (and if you look at the external-drive-move-bug ...) what else is there? sigh

my macbook pro is now connected to my macbook (this one still runs 10.4) and data rescue II is scanning the macbook pros disk via firewire. its all that i can do now ...

Reply

Answer 3

Nov 25, 2007 2:49 PM in response to ecolot

i actually have the exact same problem!!!!

this is the craziest thing i've ever seen.

and to think that i though that the guest account reset was a really cool feature!!!

never though a unix 03 certified system could screw user permissions so BAAAAD

any ideas on how to go about this?

thanks,

jon

Reply

Answer 4

MJWeb

Level 1

125 points

Nov 28, 2007 7:38 PM in response to Jonathan T

Wow, that's bad news! Obviously, don't log out until you clone your drive or user directory. Also, call Apple. Good luck.

Reply

Answer 5

Nov 29, 2007 1:30 PM in response to MJWeb

I have the same huge problem here, and i dare not log out. I'm cloning my disk at the moment, eagerly anticipating a solution.

Is it not possible to restore a file containing the proper ownership settings using time machine?

Reply

Answer 6

biovizier

Level 5

7,925 points

Nov 29, 2007 1:47 PM in response to gudbandsdalsost

Are you saying the warning message about erasing the "home" directory popped up, but you are logged in to a non-Guest account? And that you realized what it was saying and are in the process of backing up your data before logging out?

Once you are sure that your backup is complete and in good shape, one thing that might prevent your "home" from being deleted is "locking" something.

Locking the whole "home" folder would have the best chance of working, but might prove inconvenient for general use. However, while tinkering with the "Guest" account, I noticed that the presence of a single locked file or folder anywhere in the "home" folder was enough to prevent the deletion of the "/Users/Guest" folder. I have no way of knowing if the same conditions apply when the system incorrectly thinks your account is the "Guest" account, though. Items can be locked by ctrl-clicking them in "Finder", choosing "Get Info" and checking the "Locked" checkbox.

Also, it might be interesting to see if any processes are running as "Guest". Eg. if anything turns up if you launch "/Applications" > "Utilities" > "Terminal.app" and enter:<pre>id
ps aux |grep [G]uest</pre>

Sorry, I haven't used "Time Machine" first hand so I can't offer any advice about restoring a full "home" folder from a "Time Machine" backup.

Edit: Actually, I wonder if you called Apple if they could get you in touch with an engineer before logging out. This is a serious issue, but its incidence seems pretty low which probably makes it hard to debug. An Apple engineer would presumably have some idea of how to go about examining the state of your machine...

Reply

Answer 7

Nov 29, 2007 3:30 PM in response to biovizier

The message (exactly the same one as in guest account) pops up in my Admin account, which is the only account on my computer. No processes belonging to guest is running. My worries are that my backup will have the same problem, so when i am booting into the clone, that one will also be erased. It is afterall a clone. By then i will have figured out if locking a file/folder was suficcient to prevent this.

Calling Apple seems to be the only way really.

Actually, I just thought of another thing to try when the cloning has finished. Using time machine I can restore /Library or ~/library from the day before my latest boot. That should deal with it don't you think?

What I have tried:
logging in to, then out of a guest account.
deactivating guest accounts
repairing permissions
run an almost full onyx automation.

Reply

Answer 8

nerowolfe

Level 6

13,090 points

Nov 29, 2007 5:00 PM in response to gudbandsdalsost

Some interesting things about the guest account:
http://thelameleopard.wordpress.com/2007/11/07/taking-a-closer-look-at-leopards- guest-account/

Reply

Answer 9

nerowolfe

Level 6

13,090 points

Nov 29, 2007 5:02 PM in response to ecolot

I wonder what would have happened if you forced a shutdown before the files were deleted. Would they have been erased on reboot? Or might that have saved them?
This account sounds dangerous to me. Best to leave it off.

Message was edited by: nerowolfe

Reply

Answer 10

Nov 30, 2007 9:29 AM in response to ecolot

I found a solution that seems to be harmless. I thougt i would quit all of my processes, like quicksilver, salling clikcer, different helpers to se if it would make a difference. Then I saw the process loginwindow, and quit it, by using activity monitor. I didn't know the function of this process, but i thought that leopard would notify me if killing it had a more serious outcome (like trying to quit windowserver in tiger did). But it didn't so I was abruptly logged out. I logged in again, and everything was there. I restarted again, and everything seems to be untouched. The malplaced guest-quit message is gone. I won't draw any conclusions from this as I'm not sure it behaves this well all the time.

Message was edited by: gudbandsdalsost

Reply

Answer 11

Nov 30, 2007 9:48 AM in response to gudbandsdalsost

I see now that it did warn me, I must have overlooked it.

Reply

Answer 12

MJWeb

Level 1

125 points

Dec 2, 2007 12:21 PM in response to gudbandsdalsost

So, are you OK now or did you get the erase warning again? With a clone in hand you could do a fresh Leopard install and then use Migration Assistant. I'd definitely call Apple if it's not straightened out.

Reply

Answer 13

Dec 2, 2007 12:30 PM in response to MJWeb

It's all good:) No freaky messages, and nothing lost.

Reply

Answer 14

MJWeb

Level 1

125 points

Dec 2, 2007 2:07 PM in response to gudbandsdalsost

cool:)

Reply

Answer 15

Dec 8, 2007 4:02 PM in response to MJWeb

I had the same thing happen and followed your directions, everything seems fine now. Lucky for me I noticed when the restart dialog warned me it was going to delete my stuff, so I hit cancel and backed up my Home Folder using both Time Machine and .Mac Backup, just in case. But yeah, if you get this message, just kill loginwindow, log back in, and then restart.

FYI to everyone, turn off Guest Account, it's too dangerous the way it is. Hopefully apple will fix it, or at least offer the option to disable the whole "delete the account when done" "feature"

Reply