One for the Mac nerds..

[D'Artagnan]

Hey all,

A mate of my brothers over east just rang because he's had a disaster on his Mac. Being a Mac n00b I couldn't help but I thought I'd ask here....

Step to his disaster:

1. Tried to install Norton Antivirus on his Mac (didn't work)
2. Decided to bootcamp his iMac to get back to something familiar (and so he could install NAV - no, I don't understand this either)
3. Bootcamp failed for some unknown, but probably a noob error
4. He managed to get back to Macos (maybe a reinstall, he can't / won't tell me)
5. All his data is gone, everything, baby photos included
6. His wife has called the police to inform them of a impending murder,...

So the question is, is there any decent mac recovery (prefer free) software as the quote to send it off to get data back is stupidly high.

Any help appreciated.

D'Art

ps, before anyone asks, no I'm not being paid to do this and if I was, I'd happily pass the money on. It's just a favour.

[pink bits]

pineapple.jpg

sent from my buggy macbook OS

[thro]

Insert mac boot media, restore from time machine backup. Could not be simpler.


Oh what's that? No time machine backup?



Good luck with that.


edit:
For him to have erased all his shit, he would have had to go through more than 1 prompt of something like "do you want to erase all of your data" on leopard. On snow leopard, you don't even get the option unless you manually go and erase the disk on reinstall. I haven't reinstalled lion whilst trying to restore yet, so i'm presuming it works the same way as snow leopard - defaulting to keeping your data.

So if thats what he's done.... well..... the murder is justified?

[D'Artagnan]

Yeah not really sure what he's done (being 40,000 miles away) but he says he needs to recover off the drive so I'm assuming no backup and no time machine...and BSD tools that work maybe?

[mattDC5R]

Like thro said you'd be doing pretty well to actually delete stuff without knowing about it.

He hasn't just created another user account somehow , hence thinking he has deleted stuff.

Look in account on preferences or 'apple menu' - log out XX to see if he can change accounts.

Also if he has deleted his account depending on how he did that, the old account contents may be visible under the 'users' file.

[thro]

^^ good thinking, it could just be in a different account... unless he did something like boot camp windows and then re-partition his disk from within the windows OS? but... again... deliberately going out of your way to delete your shit will result in success most of the time....


edit:
just to make something clear. he's probably best off taking the machine to the genius bar or data recovery experts ASAP. most user level undelete tools will not work across operating system reinstalls....

in cases of data loss where re-partitioning and stuff like that is involved, the more failed attempts are reading/writing and re-arranging data on the disk, the less likely he is to ever get it back. data recovery is expensive but you're paying for someone's expertise to get it right the first time so that your data isn't clobbered forever.

he's clearly shown that he has no idea on how to keep his data, let alone retrieve it - rather than going by chinese whispers from 40,000 miles away, he's probably best off finding a local data recovery expert ASAP, and explaining exactly, step by step what he has done.

If he doesn't even know what he has done exactly, then the chances are getting more and more remote of him being able to undo the damage.


lesson #1: $100 for an external drive to use for time machine is cheap insurance.

[Pinkee]

seems like mac isnt fool proof afterall.

not norton but seems that if you install something that mac doesnt like, then it is a shit fight to get it off...

Mac OSX - Snow Leopard install failure | Symantec Connect Community

[Desmo]

Considering he hasn't got a clue how or why HE fucked it, he really shouldn't be touching it trying to get his data back.

[jbb]

If it was me that stuffed something like that up, I would rip the HDD out and place it into another computer and recover that way. The more you do on the HDD the more chance you have of losing info that is/was there. As stated before though if you do make a stuff up like that and don't know what you did, you are probably only going to make things worse.

External HDD are the best solution for everything really. I recently built a computer with backup drives in RAID and it still has an external HDD as another backup too; so there are 3 copies of all the data at any one time. With a few minutes of scripting you can make any computer backup all your files with the click of a button while you go out and grab a coffee. Do that once a week and your saved!

[thro]

friends don't let friends install symantec, irrespective of OS


edit:
you don't even need scripting to use time machine. plug in external disk. "would you like to use this to back up with time machine?"

answer: yes


job done.

[Cam]

Your friend has properly fucked it and needs to go to a mac specialist now, before he fucks it even further.

Sent from my HTC Desire using Tapatalk

[D'Artagnan]

Thanks for all the advice guys. He's in country NSW so it might be an effort to get it back to Apple but that will be my advice.

[D'Artagnan]

Just a follow up, in case anyone else is interested.

I remoted to his mac and had a chat and got the full story. He basically decided to upgrade NAV but the upgrade required Lion. After installing Lion he lost access to his data. Some internet forum told him to re-partition his drive and install Snow Leopard on one partition, boot to that and recover the data (urgh).

So now he has 2 (untitled 1 and untitled 2) partitions with no data and only Snow Leopard installed.

I have managed to get recoverjpeg compiled on my machine and copied over and it has recovered about 15,000 photos (@25% scanned) so far including the photos of their deceased child so for now his life is safe

Running TestDisk and Photorec gave me a bunch of errors which I'll get to because I want to use photorec which can recover more than photos (hopefully so the Taxman doesn't kill him) but I'll wait until the photos are all recovered first. Hopefully at that point we'll have everything off and onto the external drive and then they can rebuild from scratch.

Thanks everyone for your assistance.

D'Art

[D'Artagnan]

friends don't let friends install symantec, irrespective of OS

You're right. But he did this all on his own. My brother got a pasting for letting him! :p

Out of interest, what do Mac users use for Malware, Spyware, A/v etc?

[Phildo]

Out of interest, what do Mac users use for Malware, Spyware, A/v etc?

Common sense. The decision to use a Mac.

Mac users get pretty much no grief with all that stuff.

With your guy, it would be worth replacing the hard drive with a new one, and keeping the old one stored away. Just in case there is something else that he might need to recover in the future, or another recovery method/software becomes available.

Tell him to buy a Time Capsule - it is a gadget that backs everything up in the background, either via network cable or wireless. Get one. This is not negotiable. He can take his pick of $268 for the 2Tb one or $449 for 3Tb. One of those would have made this situation a very minor hiccup.

Mac Accessories - Apple Store (Australia)

Edit: and if he's got photos that are so important (ie deceased child), then explain to him that hard drives do die regularly. He needs to at least get the photos put onto DVD and make multiple copies. Even do so with different brands of DVD media, so if one doesn't read in years time then one of the others will. This is the big disadvantage of digital photos - in the old days you had strips of film, which you could put away easily for years and decades.

[thro]

Just a follow up, in case anyone else is interested.

I remoted to his mac and had a chat and got the full story. He basically decided to upgrade NAV but the upgrade required Lion. After installing Lion he lost access to his data. Some internet forum told him to re-partition his drive and install Snow Leopard on one partition, boot to that and recover the data (urgh).

Having done 2 upgrades from Snow Leopard to lion on 2 different machines...

I suspect he must have created a new account. Somehow. Not sure how.

My upgrades were seamless, and all my data was in-tact.



However, re-partitioning stuff without having a backup is often going to end in tears... Backup. Backup. Backup! Whatever OS.


edit:
i currently have sophos installed, but its only because i'm curious to know if i'm going to see any mac malware in the wild. I've yet to see any that can actually own the machine since switching in 2008.

As with the PC, if you stay away from wares, porn, etc then your chances of getting owned are much lower. Due to the lack of mac malware in the wild, its far less than windows in those circumstances.


Further to what phildo said. If he's too cheap for a time capsule, at least get an external drive, and let time machine use it. It is cheap insurance. When i upgraded from my mini to my macbook pro, i simply pointed the new machine at my backup and 1/2 hr later i had all my shit, exactly as it was. Apps, documents, etc. Time machine is awesome. Its the first backup solution i have ever seen (and i've been doing this shit since 1989) that is easy enough to not be a pain in the arse to use.

[Wedge]

What OS was he upgrading from? Leopard or Tiger? Interested to know because I'm going to be doing an upgrade from Tiger soon and may have a similar issue..

P.S there are more and more virus's etc coming out for Mac as Mac market share grows, last I heard it's still only about 5%. For example a few of the latest virus, exploit stories in the past few months. Unfortunately the more market share they gain the more people will start to turn their attention to it.

http://www.theregister.co.uk/2011/10/19/mac_trojan_attacks_apple_defences/
http://www.theregister.co.uk/2011/10/20/acobe_flash_webcam_spying/
http://www.theregister.co.uk/2011/10/13/mac_trojan_innovates/
http://www.theregister.co.uk/2011/09/23/mac_malware_pdf_disguise/
http://www.theregister.co.uk/2011/06/01/mac_osx_scareware_evasion/

[Phildo]

If he's too cheap for a time capsule, at least get an external drive, and let time machine use it. It is cheap insurance.

If he's too cheap to buy a Time Capsule, then he obviously doesn't value the photos very highly. Make sure that you inform his missus of the backup options.

P.S there are more and more virus's etc coming out for Mac as Mac market share grows, last I heard it's still only about 5%. For example a few of the latest virus, exploit stories in the past few months. Unfortunately the more market share they gain the more people will start to turn their attention to it.

If something nasty comes out, then it's a pretty safe bet that Apple will release a security update very, very quickly. Even if Mac OS X does become a major target, at least we now have the luxury of almost everyone having fast internet, so getting everyone updated will be a lot quicker and easier than it was 10 years ago.

[thro]

the mac will never have the same prevalence of viruses as windows, and here's why:

- safari is sandboxed with full DEP and ASLR in lion. what does this mean? a buffer overflow is fucking exceedingly hard to exploit.
- mail doesn't support active script
- all apps store apps as of november need to be fully sandboxed (with ASLR, as with safari, same benefit applies)
- the average user is not running as root all the time, and mac apps have historically been well behaved. you don't need to run any general apps with admin privs, ever.
- upgrades are cheap, and people do them. try and find someone running a version of mac os from 2001-2002 (XP era) with all the broken design and security problems that would entail

could someone write exploits as easily as for Windows for Snow Leopard or previous? Sure. However mac users actually upgrade (unlike the Windows XP brigade) because upgrades are cheap and new software requires them. Snow leopard and previous are going to be a fairly small market share within 12 months.

windows is unfortunately built to (still) support various pieces of broken old business software going back to DOS. Apple shit-cans support for things when they've been deprecated for about 5 years. This means they are not constantly trying to support broken old applications that were written in the days of single user non-networked computing.

[mekon]

If he's too cheap to buy a Time Capsule, then he obviously doesn't value the photos very highly. Make sure that you inform his missus of the backup options.

If something nasty comes out, then it's a pretty safe bet that Apple will release a security update very, very quickly. Even if Mac OS X does become a major target, at least we now have the luxury of almost everyone having fast internet, so getting everyone updated will be a lot quicker and easier than it was 10 years ago.

Thanks Phildo, was looking for a way to easily time capsule both machines, plus make my printer wireless.