Unknown recovered files

Question

I just had a major problem with my Drobo, it was failing to appear on the desktop. I ran Disk Warrior and it successfully rebuilt the drive and everything looks OK at first glance. Disk Warrior created a folder called Missing Folder within Rescued Items folder on the Drobo.Looking at the files in this folder I don&#x27;t recognise them. Are these important or have they been replicated in the rebuild process and can be deleted? Any advice would be gratefully received.File names are:0.indexPostings0.indexUpdates0.shadowIndexGroups0.shadowIndexHeadindexStatejournalExclusionjournalLivejournalSynclive.0.indexArrayslive.0.indexCompactDirectorylive.0.indexDirectorylive.0.indexGroupslive.0.indexHeadlive.0.indexIdslive.0.indexPositionslive.0.indexPostingslive.0.indexUpdateslive.0.shadowIndexGroupslive.0.shadowIndexHeadlive.1.indexArrayslive.1.indexCompactDirectorylive.1.indexDirectorylive.1.indexGroupslive.1.indexHeadlive.1.indexIdslive.1.indexPositionslive.1.indexPostingslive.1.shadowIndexGroupslive.1.shadowIndexHeadlive.2.indexArrayslive.2.indexCompactDirectorylive.2.indexDirectorylive.2.indexGroupslive.2.indexHeadlive.2.indexIdslive.2.indexPositionslive.2.indexPositionTablelive.2.indexPostingslive.2.indexTermIdslive.2.indexUpdateslive.2.shadowIndexArrayslive.2.shadowIndexCompactDirectorylive.2.shadowIndexDirectorylive.2.shadowIndexGroupslive.2.shadowIndexHeadlive.2.shadowIndexPositionTablelive.2.shadowIndexTermIdsshutdown_timestore.dbstore.updatesHappy Easter,Mike

a brody · Accepted Answer

It sounds like the App or iTunes Store is sending info about what was purchased to your drobo instead of the Mac.  I&#x27;d ask the App Store customer service why this is happening, and if you can get those files restored from their data of what you&#x27;ve purchased.   Index data will be restored if you let Spotlight reindex your drive.  Journalling is just part of the file system management of your data, and will be restored automatically as you use the drive.

KitKat007 · Answer

I put a usb drive in my mac (not the first time) and when I tried to use it again it displayed a very similar set of files as the above situation. I cannot access my real files,  and I have read only rights now to my drive but volume used indicates that somewhere in the usb drive my files exist. can you help?

chase_daniel · Answer

I have all the same files and have never even heard of Drobo. I believe they&#x27;re something to do with XAgent malware  which I think is being called AgentX at least on my system. It replicates throughout everything that in anyway can connect to your device particularly through Bluetooth PAN but I suspect regular Bluetooth is a potential source as its identical to any standard network interface you&#x27;d ordinarily use to get online like WiFi except it&#x27;s slower still plenty fast for malware payloads. An iPhone can spread it to any device it interacts with. It&#x27;s well documented and it may be impossible to remove. Why hasn&#x27;t anyone heard of this? No? Wonder why.

chase_daniel · Answer

I&#x27;ve have time machine backups that are showing modified system files starting about May of 2011. Odd this original question is from April 2011.This is all from a "blank" logical volume just erased in using the Disk Utility App. I&#x27;m trying to figure out why I have 200+ MB of data after erasing drives. It maybe nothing but it just seems odd that this would be stuck there. I&#x27;ve seen no trustworthy explanation of any cause so I must assume the worst since the typical attitude would be that it&#x27;s nothing to worry about.Below are the files on the disk, notice the _unknown user who owns many of them. The date is off, it was erased yesterday July 8 2017 but dates go back to July 1 for some reason. I just pasted this from the Terminal where&#x27;s its displayed using the default black text on a white background but it pasted here in what looks like the "Grass" color scheme which I have never once used.Apologies in advance to all of you who&#x27;ve turned to stone from viewing stdout.drwxrwxr-x  8 root      admin      340 Jul  3 07:38 .drwxr-xr-x@ 7 root      wheel      238 Jul  8 21:52 ..-rw-r--r--@ 1 _unknown  _unknown  8196 Jul  7 17:13 .DS_Storedrwx------  5 _unknown  _unknown  170 Jul  1 14:18 .Spotlight-V100d-wx-wx-wt  3 root      wheel      102 Jul  8 21:49 .Trashesdrwx------  9 _unknown  _unknown  306 Jul  8 21:50 .fseventsd/Volumes/4//.Spotlight-V100:total 8drwx------  5 _unknown  _unknown  170 Jul  1 14:18 .drwxrwxr-x  8 root      admin      340 Jul  3 07:38 ..drwx------  3 _unknown  _unknown  102 Jul  1 14:18 Store-V1drwx------  3 _unknown  _unknown  102 Jul  1 14:18 Store-V2-rw-------  1 _unknown  _unknown  4006 Jul  1 14:18 VolumeConfiguration.plist/Volumes/4//.Spotlight-V100/Store-V1:total 8drwx------  3 _unknown  _unknown  102 Jul  1 14:18 .drwx------  5 _unknown  _unknown  170 Jul  1 14:18 ..-rw-------  1 _unknown  _unknown  348 Jul  1 14:18 VolumeConfig.plist/Volumes/4//.Spotlight-V100/Store-V2:total 0drwx------  3 _unknown  _unknown  102 Jul  1 14:18 .drwx------  5 _unknown  _unknown  170 Jul  1 14:18 ..drwx------  66 _unknown  _unknown  2244 Jul  7 18:17 70491854-53C4-4610-AEE2-28DB3175DF5E/Volumes/4//.Spotlight-V100/Store-V2/70491854-53C4-4610-AEE2-28DB3175DF5E:total 1600drwx------  66 _unknown  _unknown    2244 Jul  7 18:17 .drwx------  3 _unknown  _unknown    102 Jul  1 14:18 ..-rw-------  1 _unknown  _unknown  118784 Jul  8 21:55 .store.db-rw-------  1 root      _unknown  65536 Jul  8 21:50 0.directoryStoreFile-rw-------  1 root      _unknown    1088 Jul  7 18:17 0.directoryStoreFile.shadow-rw-------  1 root      _unknown  66240 Jul  7 18:17 0.indexArrays-rw-------  1 root      _unknown      8 Jul  7 18:17 0.indexCompactDirectory-rw-------  1 root      _unknown    2056 Jul  7 18:17 0.indexDirectory-rw-------  1 root      _unknown      2 Jul  7 18:17 0.indexGroups-rw-------  1 root      _unknown    4096 Jul  7 18:17 0.indexHead-rw-------  1 root      _unknown      16 Jul  7 18:17 0.indexIds-rw-------  1 root      _unknown      8 Jul  7 18:17 0.indexPositions-rw-------  1 root      _unknown    100 Jul  7 18:17 0.indexPostings-rw-------  1 root      _unknown      12 Jul  7 18:17 0.indexUpdates-rw-------  1 root      _unknown      2 Jul  7 18:17 0.shadowIndexGroups-rw-------  1 root      _unknown    4096 Jul  7 18:17 0.shadowIndexHead-rw-------  1 _unknown  _unknown      0 Jul  1 14:18 Cab.created-rw-------  1 _unknown  _unknown      0 Jul  1 15:39 Cab.modified-rw-------  1 _unknown  _unknown      0 Jul  1 14:18 Lion.created-rw-------  1 _unknown  _unknown      28 Jul  8 21:50 indexState-rw-------  1 _unknown  _unknown      0 Jul  1 14:18 journalExclusiondrwx------  2 _unknown  _unknown      68 Jul  1 14:18 journals.assisted_import_postdrwx------  2 _unknown  _unknown      68 Jul  1 14:18 journals.assisted_import_predrwx------  2 _unknown  _unknown      68 Jul  1 14:18 journals.corespotlightdrwx------  2 _unknown  _unknown      68 Jul  1 14:18 journals.health_checkdrwx------  2 _unknown  _unknown      68 Jul  1 14:18 journals.livedrwx------  2 _unknown  _unknown      68 Jul  1 14:18 journals.live_prioritydrwx------  2 _unknown  _unknown      68 Jul  1 14:18 journals.live_systemdrwx------  2 _unknown  _unknown      68 Jul  1 14:18 journals.live_userdrwx------  2 _unknown  _unknown      68 Jul  1 14:18 journals.migrationdrwx------  2 _unknown  _unknown      68 Jul  1 14:18 journals.migration_secondchancedrwx------  2 _unknown  _unknown      68 Jul  1 15:39 journals.repairdrwx------  3 _unknown  _unknown    102 Jul  7 11:20 journals.scan-rw-------  1 root      _unknown  65536 Jul  8 21:50 live.0.directoryStoreFile-rw-------  1 root      _unknown    1088 Jul  7 18:17 live.0.directoryStoreFile.shadow-rw-------  1 root      _unknown  65536 Jul  8 21:50 live.0.indexArrays-rw-------  1 root      _unknown    1024 Jul  8 21:50 live.0.indexCompactDirectory-rw-------  1 root      _unknown    8224 Jul  8 21:50 live.0.indexDirectory-rw-------  1 root      _unknown    3277 Jul  8 21:50 live.0.indexGroups-rw-------  1 root      _unknown    4096 Jul  7 18:17 live.0.indexHead-rw-------  1 root      _unknown  32768 Jul  8 21:50 live.0.indexIds-rw-------  1 root      _unknown    8192 Jul  8 21:50 live.0.indexPositionTable-rw-------  1 root      _unknown    4096 Jul  8 21:50 live.0.indexPositions-rw-------  1 root      _unknown    4096 Jul  8 21:50 live.0.indexPostings-rw-------  1 root      _unknown    8192 Jul  8 21:50 live.0.indexTermIds-rw-------  1 root      _unknown      0 Jul  7 18:17 live.0.indexUpdates-rw-------  1 root      _unknown  65536 Jul  7 18:17 live.0.shadowIndexArrays-rw-------  1 root      _unknown      8 Jul  7 18:17 live.0.shadowIndexCompactDirectory-rw-------  1 root      _unknown    2056 Jul  7 18:17 live.0.shadowIndexDirectory-rw-------  1 root      _unknown      1 Jul  7 18:17 live.0.shadowIndexGroups-rw-------  1 root      _unknown    4096 Jul  7 18:17 live.0.shadowIndexHead-rw-------  1 root      _unknown      0 Jul  7 18:17 live.0.shadowIndexPositionTable-rw-------  1 root      _unknown      0 Jul  7 18:17 live.0.shadowIndexTermIds-rw-------  1 root      _unknown      18 Jul  8 21:50 permStore-rw-------  1 _unknown  _unknown  65536 Jul  8 21:50 reverseDirectoryStore-rw-------  1 _unknown  _unknown    3136 Jul  1 14:18 reverseDirectoryStore.shadow-rw-------  1 _unknown  _unknown      1 Jul  8 21:50 reverseStore.updates-rw-r--r--  1 _unknown  _unknown      4 Jul  8 21:55 shutdown_time-rw-------  1 _unknown  _unknown  118784 Jul  7 18:17 store.db-rw-------  1 _unknown  _unknown      8 Jul  8 21:50 store.updates-rw-r--r--  1 _unknown  _unknown      4 Jul  1 14:18 store_generation-rw-------  1 _unknown  _unknown      0 Jul  1 14:18 tmp.Cab-rw-------  1 _unknown  _unknown      0 Jul  1 14:18 tmp.Lion-rw-------  1 _unknown  _unknown      0 Jul  1 14:18 tmp.SnowLeopard-rw-------  1 _unknown  _unknown    1968 Jul  1 14:18 tmp.spotlight.loc-rw-------  1 _unknown  _unknown    4096 Jul  8 21:50 tmp.spotlight.state/Volumes/4//.Spotlight-V100/Store-V2/70491854-53C4-4610-AEE2-28DB3175DF5E/journa ls.assisted_import_post:total 0drwx------  2 _unknown  _unknown    68 Jul  1 14:18 .drwx------  66 _unknown  _unknown  2244 Jul  7 18:17 ../Volumes/4//.Spotlight-V100/Store-V2/70491854-53C4-4610-AEE2-28DB3175DF5E/journa ls.assisted_import_pre:total 0drwx------  2 _unknown  _unknown    68 Jul  1 14:18 .drwx------  66 _unknown  _unknown  2244 Jul  7 18:17 ../Volumes/4//.Spotlight-V100/Store-V2/70491854-53C4-4610-AEE2-28DB3175DF5E/journa ls.corespotlight:total 0drwx------  2 _unknown  _unknown    68 Jul  1 14:18 .drwx------  66 _unknown  _unknown  2244 Jul  7 18:17 ../Volumes/4//.Spotlight-V100/Store-V2/70491854-53C4-4610-AEE2-28DB3175DF5E/journa ls.health_check:total 0drwx------  2 _unknown  _unknown    68 Jul  1 14:18 .drwx------  66 _unknown  _unknown  2244 Jul  7 18:17 ../Volumes/4//.Spotlight-V100/Store-V2/70491854-53C4-4610-AEE2-28DB3175DF5E/journa ls.live:total 0drwx------  2 _unknown  _unknown    68 Jul  1 14:18 .drwx------  66 _unknown  _unknown  2244 Jul  7 18:17 ../Volumes/4//.Spotlight-V100/Store-V2/70491854-53C4-4610-AEE2-28DB3175DF5E/journa ls.live_priority:total 0drwx------  2 _unknown  _unknown    68 Jul  1 14:18 .drwx------  66 _unknown  _unknown  2244 Jul  7 18:17 ../Volumes/4//.Spotlight-V100/Store-V2/70491854-53C4-4610-AEE2-28DB3175DF5E/journa ls.live_system:total 0drwx------  2 _unknown  _unknown    68 Jul  1 14:18 .drwx------  66 _unknown  _unknown  2244 Jul  7 18:17 ../Volumes/4//.Spotlight-V100/Store-V2/70491854-53C4-4610-AEE2-28DB3175DF5E/journa ls.live_user:total 0drwx------  2 _unknown  _unknown    68 Jul  1 14:18 .drwx------  66 _unknown  _unknown  2244 Jul  7 18:17 ../Volumes/4//.Spotlight-V100/Store-V2/70491854-53C4-4610-AEE2-28DB3175DF5E/journa ls.migration:total 0drwx------  2 _unknown  _unknown    68 Jul  1 14:18 .drwx------  66 _unknown  _unknown  2244 Jul  7 18:17 ../Volumes/4//.Spotlight-V100/Store-V2/70491854-53C4-4610-AEE2-28DB3175DF5E/journa ls.migration_secondchance:total 0drwx------  2 _unknown  _unknown    68 Jul  1 14:18 .drwx------  66 _unknown  _unknown  2244 Jul  7 18:17 ../Volumes/4//.Spotlight-V100/Store-V2/70491854-53C4-4610-AEE2-28DB3175DF5E/journa ls.repair:total 0drwx------  2 _unknown  _unknown    68 Jul  1 15:39 .drwx------  66 _unknown  _unknown  2244 Jul  7 18:17 ../Volumes/4//.Spotlight-V100/Store-V2/70491854-53C4-4610-AEE2-28DB3175DF5E/journa ls.scan:total 0drwx------  3 _unknown  _unknown  102 Jul  7 11:20 .drwx------  66 _unknown  _unknown  2244 Jul  7 18:17 ..-rw-------  1 root      _unknown    0 Jul  7 11:20 retire.170/Volumes/4//.Trashes:total 0d-wx-wx-wt  3 root  wheel  102 Jul  8 21:49 .drwxrwxr-x  8 root  admin  340 Jul  3 07:38 ..drwx------@ 2 a1    wheel  68 Jul  8 21:49 501/Volumes/4//.Trashes/501:total 0drwx------@ 2 a1    wheel  68 Jul  8 21:49 .d-wx-wx-wt  3 root  wheel  102 Jul  8 21:49 ../Volumes/4//.fseventsd:total 56drwx------  9 _unknown  _unknown  306 Jul  8 21:50 .drwxrwxr-x  8 root      admin    340 Jul  3 07:38 ..-rw-------  1 root      _unknown  72 Jul  8 21:50 0000000000002990-rw-------  1 root      _unknown  69 Jul  8 21:50 0000000000002991-rw-------  1 root      _unknown  43 Jul  8 21:50 000000000000513e-rw-------  1 root      _unknown  70 Jul  8 21:50 000000000000513f-rw-------  1 root      _unknown  38 Jul  8 21:50 0000000000005140-rw-------  1 root      _unknown  70 Jul  8 21:50 0000000000005141-rw-------  1 root      _unknown  36 Jul  8 21:50 fseventsd-uuidHexdump doesn&#x27;t show me what could be taking up that much space either it just says "shadow volume" a lot. Please notice the // thats been used.

Mike Turner · Answer

Thanks for the response and I apologise for my delay in responding. I have two drobo and the itunes stuff generally goes to the other one. I will do some checking based on the file dates, but thanks very much for setting my mind at ease.Mike