Students loosing 2 years and 1 week worth of data.

First, I want to clarify that I haven't personally experienced this issue, which makes it challenging for me to provide a detailed description of its cause. I'm part of the IT team at a university, and recently, we've encountered two incidents involving MacBooks losing data. The first case was about two weeks ago, and the most recent one was yesterday. Unfortunately, I lack a direct means of contacting these students unless I happen to see them in person, so I can't guarantee that I'll be able to offer any answers or updates.

Also my first language is not english so apologies if it reads terrible (As you can probably tell i have used chatgpt to help me) but i figured english would reach more people.


The reason I'm posting this is to see if anyone might know what to do if this happens again, along with my concern that it might affect my MacBook as well.

The first incident occurred about two weeks ago and involved a student who used her MacBook until the battery was completely drained. When she plugged it in and turned it back on, the MacBook had inexplicably rolled back in time by two years. All her files, documents, and other data displayed a last modification date of 2021. And her accounts had reverted to their previous states. Office was logged into her previous school account, and her browser was also logged into an older account. Fortunately, she had everything stored in iCloud, which allowed us to recover all of her data.


Yesterday, the second student came in with a similar problem. She had lost her exam notes, and it appeared that Word hadn't saved anything for a week. But after looking closer, we discovered that everything, from her open tabs in Chrome to her files, had reverted to the state they were in two weeks ago. Unfortunately, she had not saved any of her progress in iCloud or any other cloud storage. I wasn't able to solve it. She mentioned that this occurred a little after she started charging her MacBook. The screen went dark, and the MacBook restarted, opening in the state it's currently in.


Unfortunately, as I mentioned at the beginning, I have no means to contact them, so i cannot follow up on any suggestions, or try any possible solutions . However, in case I do encounter them or if someone else comes by with the same problem, I would like to be ready to offer assistance. Any response is greatly appreciated.


I have to assume the first student's MacBook is doing fine since she hasn't returned with it, and regrettably, I no longer remember the specs of her MacBook. So, I can only provide details on the second one, which is the more pressing problem.


  • MacBook Air M1, 2020
  • Base model
  • Monterey 12.2.1
  • No visible physical damage.


MacBook Air (M1, 2020)

Posted on Oct 18, 2023 6:26 AM

Reply
10 replies
Question marked as Helpful

Oct 18, 2023 8:31 AM in response to Benjamin_2001

Backing up is a standard protocol that has been recommended for as long as I can recall; first computer was a brand spanking new Apple ][ purchased in the '80s. It's a personal responsibility and carries personal consequences.


Unfortunately, there is no solution to complete data loss except to protect yourself in the future. And on this community that's essentially preaching to the choir.


There are two types of computer users when it comes to data: those who've lost data and those who will. Life lessons are often hard and sometimes expensive.


iCloud is not a backup solution. It can help if used consistently, but it's an interactive service with no history. What's deleted on the local drive is immediately deleted in iCloud.


Backing up is to an external, secure (as secure as practical) repository. That can be a drive or a cloud based true backup service.

Oct 19, 2023 12:48 AM in response to BDAqua

Yes, both students had laptops, I'm unsure about the first student's MacBook model, I believe it was a MacBook Air. 

Our main theory is also that the problem has to do with the battery running out and stopping some sort of task, but the data rollback issue remains a mystery. 

Unfortunately, neither student had any form of backup or Time Machine.


As for the students being beyond the practical joke stage, you’d think so considering they are university students, but it appears we’d be wrong.


(Sorry if i'm wrong but i initially understood the last part as a joke about the students age or mental capacity, which gave me a chuckle. But while writing this i realised you may be asking if they are experiencing genuine technical issues or if this could be due to intentional actions by the students. And as far as i can see, there is no benefits to this. It was private MacBooks that they will have to cover and secure themself)

Oct 19, 2023 2:26 AM in response to Benjamin_2001

I meant perhaps other students being childish with other's data, some think it's fun or funny to mess with people.


On the rollback to an earlier state, only can think there must've been at least one local snapshot...


Start Terminal from spotlight.

At the terminal type tmutil listlocalsnapshotdates. 

Hit enter.


Here, you'll now see a list of all of the locally stored Time Machine backup snapshots stored on your disk.


How much time were these Laptops out of possession of the owners between being OK & rolled back?

Oct 19, 2023 3:37 AM in response to ku4hx

Agreed, the IT team and I believe that data backups are a must. It's unfortunate that in our organization, we're not given the priority to hold courses to inform the students. Especially because majority of our students have MacBooks because they’ve been told it great for studying, and have no experience beyond that. 


I don't mean to sound harsh, but this is a true account. We asked the second student about her prior experience with MacOS and if she used Windows before. Her response was: "Yes, I'm new to MacOS. I got a MacBook because the guy at the store said they were great for students, but my previous computer wasn't Windows, it was an Acer."

And I know that there are "Windows" PCs that could lead to this kind of statement, but I assure you, that's not what she meant.


I do believe it's a personal responsibility, and the consequences do fall on the students. However, I can't help but feel frustrated that I couldn't do anything. Cases like this tend to get under my skin, which is why I made this post even though I probably won't see them and fix it later.


Unfortunately there seems to be no solution to this data loss, especially since it involves a system-wide rollback. But this does raise an intriguing question.


If it's not just a specific program or files, but the entire machine that went back in time, would using a backup even be possible. The MacBook would be trying to backup into the future. And thats only If the backup is even there. Since she didn't have a one we couldn't check it, but if the entire machine went back wouldn't it go back to before the backup was made?


But at this point i'm more interested in the cause then anything else.

Oct 19, 2023 4:01 AM in response to BDAqua

As I understood it, the first student was using the laptop at home until the battery drained completely. After plugging it in and booting it up, the MacBook had rolled back to 2 years ago. The second student was using her laptop here on campus when it happened. From what I've gathered, neither of them were away from their laptops when these issues occurred.


Running tmutil listlocalsnapshotdates on my Macbook gives me :

  • Snapshot dates for all disks:

And then it doesn't say anything. But this is a work Mac owned by the org, so maybe there is something stopping it.

Unfortunately i do not have the ability to contact these students, so i can not ask them to try it.

Oct 19, 2023 4:13 AM in response to BDAqua

These are personal MacBooks bought and owned by students.


However, the one that I tested is under the school's control. I ran it with my administrator account, but I'm unsure if the school's ownership affects the 'listlocalsnapshotdates' command.


It wasn't a fresh install, the rollback included the newest data up until the time they reverted to. So, the newest documents were the ones saved two years ago and one week ago.


Since the first student found her stuff in iCloud, I didn't look further. But I did check with the second student, and there were no local backups.

Students loosing 2 years and 1 week worth of data.

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.