Rather Shocking OS X Bug Discovered -> Files Vanish

Question

Rather Shocking OS X Bug Discovered -> Files Vanish

Well, I've always chalked it up to user error for long enough ---- this weekend made me realize that it never has been.

Twice yesterday, and four times today, a file I was working on simply disappeared from my Desktop. Vanished, gone, poof.

I've been working on an RTF file that I periodically export to PDF on the Desktop, and this exported PDF is a file that I need to email off when I make changes to it. The only applications that directly use this file are TextEdit, whatever TextEdit uses to render them to PDF, and Mail.app.

Periodically, the PDF file just ceases to exist. When I go to email it off, the one I am looking for is no longer there. It's gone.

Now, when I say gone, I mean gone. It's not in the trash, it's not findable via the terminal, the shell, or any conventional filesystem tool. I am a Linux Systems Administrator, and I spend 70% of my life in the shell, so if it's there, I'll find it.

To make matters worse, there are no messages in the OS X console which give any hint as to what has happened to the file.

As I mentioned, this has happened to me numerous times since I've upgraded to "Mountain Lion" (I'm currently using 10.8.5).

I've reported mysterious file loss on various forums before, with two different Macs … but, well, the consensus was always user error. You know how that goes in the Mac world sometimes. 50 "that never happens to me, therefore it must be you" replies, and to be fair, I don't completely blame them. I've seen users do some pretty goofy things over the years, so skepticism is not unwarranted. Especially since, in 2013 at least, operating systems don't just delete files randomly.

Except that they do. This weekend, it's happened six times.

So, I'm here to tell you, it's not your imagination my friends. OS X has a pretty gnarly bug that indiscriminately, randomly, and without warning or notice … quietly deletes files. It's happen most recently on my Desktop, but I can't say with any certainty that it doesn't happen in other areas of the filesystem as well.

It may not happen to most of you, or even many of you, but I've paid close attention this weekend, and it does indeed happen.

The question is, why?

I don't spend enough time in the Darwin source code to offer a hypothesis, and I'll concede that a low-level knowledge of HFS is not my specialty.

Any help?

As someone who mucks around all day as 'root' in 15+ different mission-critical servers, I assure you that accidentally deleting files is not something that I do very often.

This happens on two of my Macs, so it's definietely not hardware related, and when I mentioned it to a collegue, he said "Hey, that's happened to me too! I thought I must have deleted it by accident!"

That seems to be a running assumption.

Fortuantnely, I do make copious backups of my laptop, so I'm only losing up to an hour's worth of data when these mystery deletions happen ... but that's still valuable time at my hourly rate.

Thanks, and have a great Columbus Day.

I trust the rest of you will spend it honoring the life of Christopher Columbus, as I will.

MacBook Pro with Retina display, OS X Mountain Lion (10.8.5)

Posted on Oct 13, 2013 4:43 PM

Reply

Answer 1

macjack

Level 10

111,168 points

Oct 13, 2013 5:01 PM in response to Miss Ann Thrope

I believe you but since many others aren't reporting this, it sounds like something specfic to your system(s).

It may be something in your User, which has been copied over to the other Mac.

The only way to be sure would be to do clean install, if you have a disk handy and test it there.

You can file feedback here.

Or send in a bug report here, after signing in for Developer (free)

https://developer.apple.com/bug-reporting/

Reply

Answer 2

Oct 13, 2013 5:09 PM in response to Miss Ann Thrope

Miss Ann Thrope

Periodically, the PDF file just ceases to exist. So, I'm here to tell you, it's not your imagination my friends. OS X has a pretty gnarly bug that indiscriminately, randomly, and without warning or notice … quietly deletes files.

Nope. 😊

I mess with more PDF files than a 1000X people combined on 5 diff. Macs.......never happened.

Reply

Answer 3

Oct 13, 2013 5:15 PM in response to macjack

Well, I'm inclined to agree with you, although I will offer this:

It can be awfully subtle.

A single file, which, if you're not happening to be paying attention to it, you may not notice is gone.

I just asked another user I know here in meatspace, and he said "hmmmm, I don't think so. I mean, I've lost files, I always just assumed I'd delete it on accident."

So, who knows?

And not to underscore that point too much, but a quick search does reveal this happening to other people. the first link from Google returns:

http://forums.macrumors.com/showthread.php?t=1265470

This does not, of course, mean that you aren't correct ... just throwing a little more food for thought out there.

Reply

Answer 4

macjack

Level 10

111,168 points

Oct 13, 2013 5:26 PM in response to macjack

Yes, you can usually find several folks with any particular problem, yet an issue like you describe would definitely have a long list of posts and BRs.

Be sure to keep good backups and I'd encourage you to do the clean install, as painful as that may be.

Reply

Answer 5

Oct 13, 2013 5:24 PM in response to PlotinusVeritas

Look, I appreciate the reply, and I don't want to be insulting. I mean this sincerely.

Since your type of reply is rather typical, however, regardless of the problem, I merely offer food for though.

A great many IQ studies have been done over the decades, and one of the more interesting outcomes they've found is that the populations which skew lower, have great difficulting envisioning the existence of things they have not personally encountered.

We see this across almost every forum nowadays, and it's the result of the Internet's mainstream acceptance. No longer is it populated by those who skew toward the cognitive high end, and instead, has come close to the population's mean.

i'm not saying it's the case here, but it's something to be aware of.

So, while I'm happy that you don't have the problem, and I'm sure others share your happiness, it's not really evidence of the non-existence of a bug.

For instance, it could occur on certain models with certain configurations, etc.

It's hard to imagine, I know, but I can promise you that things have happened which have escaped your scrutiny.

Reply

Answer 6

Oct 13, 2013 5:27 PM in response to Miss Ann Thrope

This is a interesting problem..... I'm sure that it does happen, just that, like you said, if peep's single files go MIA, they prob won't notice. Out of curiosity, have you dl'ed and used any file recovery tools to try to get those missing files back? It'd prob be easier than doing a restore one or more times a day.

Reply

Answer 7

Oct 13, 2013 5:35 PM in response to Miss Ann Thrope

This may be a long shot, but do you have any anti-virus app(s) installed? I have noticed that some of my files do disappear on my PC, even though i know they aren't viruses, and my AV ate them.

Reply

Answer 8

Oct 13, 2013 5:41 PM in response to Tommy197944

No anti-virus programs of any kind.

I may try a restore at some point, however, if restoring from backup caused my other machine to inherit this defect, then I would probably just transfer it back onto my machine.

And, like I said, it's fairly subtle and doesn't happen often. For me, it seems to nail PDF's on the Desktop when I notice it, and reading around, there is some commonality there, such as this report I found:

"I save a Word document to the desktop and then I save the same document as a PDF to the desktop. However, when I close word and go to my desktop, the files are not there. Accessing the desktop folder from Finder yields the same result. If I then reboot, I find the files on the desktop where I saved them after I log in. What causes this to happen? Any ideas?"

This doesn't happen to everyone, or even all that often to me, but there is some anamoly that happens when things line up in just the right, unusual manner.

The other thing I wonder about is if TM backups can do it. I do run an external drive which backs up hourly, and of course, the backups run even when a drive is not connected to the MobileBackups directory.

That's the other avenue I am exploring. Whether some kind of bit gets flipped on the file metadata during backup that causes it to go AWOL.

Reply

Answer 9

Oct 13, 2013 5:52 PM in response to Miss Ann Thrope

I read through your post, and I gave it all a little thought.

I've been using MacOS since Late 2007, so for 6 years now. In that entire time, I've never had MacOS "lose" a file that I ever want back to look for later. I have had times where I used a drag/drop which I thought should have copied a file and it in fact moved it. When I checked in more detail later, I found that MacOS was correct and I was wrong about if it should have copied or moved with the particular drag/drop.

Now, if this "insidious bug" were really removing random files from a MacOs system, odds are it would eventually hit a system critical file and you would not be able to boot your system or you would have critical errors at boot time. I don't see this happening to people on a regular basis, so the "random deletions" are more likely less "random" than you think. I do hate to say this, but I know many people who feel that they are experts and never make mistakes, and they "much around all day long as 'root'" and eventually they do make mistakes, and as 'root' the system blindly follows the user's instructions with no questions asked. I would give more credence to this than to a hidden "bug" in the file system "randomly" deleting files.

As others have mentioned, it is quite possible that you have dome something in your user account that is causing the issue. It is also possible that it is some other software installed on your system that might be causing the issue. I would suggest that before you re-install your system from scratch, that you start with creating a new user account that you don't migrate from an existing user account. This way, if it is a problem with your user account, you don't copy it to the new user, and you don't have to reinstall the full system.

I don't want to say that you don't have a problem, but it is difficult for me to accept that MacOS is the fault here. If MacOS were randomly deleting files, I would have expected that in the last 6 years, I would have seen it happen on one of my Macs, and I haven't.

Reply

Answer 10

Linc Davis

Level 10

209,547 points

Oct 13, 2013 6:08 PM in response to Miss Ann Thrope

Please read this whole message before doing anything.

I've tested these instructions only with the Safari web browser. If you use another browser, they may not work as described.

This procedure is a diagnostic test. It won’t solve your problem. Don’t be disappointed when you find that nothing has changed after you complete it.

Third-party system modifications are a common cause of usability problems. By a “system modification,” I mean software that affects the operation of other software — potentially for the worse. The following procedure will help identify which such modifications you've installed. Don’t be alarmed by the complexity of these instructions — they’re easy to carry out and won’t change anything on your Mac.

These steps are to be taken while booted in “normal” mode, not in safe mode. If you’re now running in safe mode, reboot as usual before continuing.

Below are instructions to enter some UNIX shell commands. The commands are harmless, but they must be entered exactly as given in order to work. If you have doubts about the safety of the procedure suggested here, search this site for other discussions in which it’s been followed without any report of ill effects.

Some of the commands will line-wrap or scroll in your browser, but each one is really just a single line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, and you can then copy it. The headings “Step 1” and so on are not part of the commands.

Note: If you have more than one user account, Step 2 must be taken as an administrator. Ordinarily that would be the user created automatically when you booted the system for the first time. The other steps should be taken as the user who has the problem, if different. Most personal Macs have only one user, and in that case this paragraph doesn’t apply.

Launch the Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.

When you launch Terminal, a text window will open with a line already in it, ending either in a dollar sign (“$”) or a percent sign (“%”). If you get the percent sign, enter “sh” and press return. You should then get a new line ending in a dollar sign.

Step 1

Triple-click anywhere in the line of text below on this page to select it:

kextstat -kl | awk '!/com\.apple/{printf "%s %s\n", $6, $7}' | open -ef

Copy the selected text to the Clipboard by pressing the key combination command-C. Then click anywhere in the Terminal window and paste (command-V). A TextEdit window will open with the output of the command. If the command produced no output, the window will be empty. Post the contents of the TextEdit window (not the Terminal window), if any — the text, please, not a screenshot. You can then close the TextEdit window. The title of the window doesn't matter, and you don't need to post that. No typing is involved in this step.

Step 2

Repeat with this line:

{ sudo launchctl list | sed 1d | awk '!/0x|com\.(apple|openssh|vix\.cron)|org\.(amav|apac|cups|isc|ntp|postf|x)/{print $3}'; echo; sudo defaults read com.apple.loginwindow LoginHook; echo; sudo crontab -l; } 2> /dev/null | open -ef

This time you'll be prompted for your login password, which you do have to type. Nothing will be displayed when you type it. Type it carefully and then press return. You may get a one-time warning to be careful. Heed that warning, but don't post it. If you see a message that your username "is not in the sudoers file," then you're not logged in as an administrator.

Note: If you don’t have a login password, you’ll need to set one before taking this step. If that’s not possible, skip to the next step.

Step 3

{ launchctl list | sed 1d | awk '!/0x|com\.apple|org\.(x|openbsd)/{print $3}'; echo; crontab -l 2> /dev/null; } | open -ef

Step 4

ls -A /e*/{cr,la,mach}* {,/}Lib*/{Ad,Compon,Ex,Fram,In,Keyb,La,Mail/Bu,P*P,Priv,Qu,Scripti,Servi,Spo,Sta}* L*/Fonts .la* 2> /dev/null | open -ef

Important: If you formerly synchronized with a MobileMe account, your me.com email address may appear in the output of the above command. If so, anonymize it before posting.

Step 5

osascript -e 'tell application "System Events" to get name of login items' | open -ef

Remember, steps 1-5 are all copy-and-paste — no typing, except your password. Also remember to post the output.

You can then quit Terminal.

Reply

Answer 11

Tlix

Level 4

1,425 points

Oct 13, 2013 6:25 PM in response to Miss Ann Thrope

Does OS X Server have an option for tracking files/deletions? If so it might be an option.

Reply

Answer 12

Oct 13, 2013 7:27 PM in response to GeekBoy.from.Illinois

I do hate to say this, but I know many people who feel that they are experts and never make mistakes, and they "much around all day long as 'root'" and eventually they do make mistakes, and as 'root' the system blindly follows the user's instructions with no questions asked. I would give more credence to this than to a hidden "bug" in the file system "randomly" deleting files.

LOL.

Hey, you could be right. I mean, I could have deleted the same file six times by accident in the past 48 hours.

And I did make some typos in an online forum, so there's always that to consider.

You know, I think you may be on to something here. Thank you for suggesting this possibility. I hadn't really thought of it, but now that I have, I do vaguely remember typing 'rm -rf ~/Desktop/my_particular_filename.pdf' a couple of times.

Do you think that might have done it?

I don't want to say that you don't have a problem, but it is difficult for me to accept that MacOS is the fault here.

This is quite possibly the least suprising thing I've ever read anywhere.

Reply

Answer 13

Oct 13, 2013 7:28 PM in response to Linc Davis

Hmmm.

Okay, thank you.

Reply

Answer 14

steve626

Level 6

9,983 points

Oct 13, 2013 11:58 PM in response to Miss Ann Thrope

When the file "disappears," can you retrieve it from one of the hourly time machine backups?

Reply

Answer 15

Oct 14, 2013 12:34 AM in response to Miss Ann Thrope

I don't know what program you use to view/edit the PDF. But many programs has a "Recently Opened". I must ask, have you checked there to see if it's in the list? If so, what happens when you click on it to open it?

KOT

Reply