Files/Folders disappeared. Malicious actor?

Late 2012 Mac Mini with Catalina. Not using iCloud or Time Machine. Yes, I am ashamed.

The only thing that was being backed up was Chrome's bookmarks and passwords.

I am the only, admin level, user, guest user is disabled. Booting into Safe Mode didn't work.

Did not notice any slower than usual behaviour before or after the event.

I was manually deleting files connected to Homebrew and Docker, using Path Finder.

Erasing files in /usr/local/homebrew folders straight, not just moving them into trash.

Also uninstalling/deleting Docker and its files under ˜/Library.

So, yeah, I could possibly done to this myself, if so, well deserved.

But. At one point I decided to restart my system for whatever reason (don't recall y).

After reboot I notice the missing files and folders:

• • empty Document, Pictures and Downloads folders
  • custom folders under my user id with more documents.
  • Firefox bookmarks and passwords, stored locally (not sync-d).
  • all notes from the Notes app.
  • the Trash bin was also emptied.
  • there were a few Chrome extensions that were flagged as 'corrupted'.
  • some localized settings for certain websites using Chrome were also missing.

If somebody wanted to do this to me, for whatever reason, they had to know what was in the custom folders, I think. But no ransomeware contact yet. Not that I could afford to pay anything. I am so poor, I use a 10+ yr old Mac Mini. Which got ton more free space now.

If I did this to myself, is there a safe, yet free utility out there that would allow me to look at the hard drive to see if anything can be salvaged?

If I was hacked, they wouldn't bother to download my files and let me continue to use the system, they'd just encrypt it until I pay up, no?

Thanks for reading.

>|K