Complete Computer System Crash

[Barry Johns]

I am in complete panic mode. My 10 year old went on my studio MacPro when I stepped out and downloaded some app to work with mindcraft. I caught it and dragged the app to the trash and then emptied the trash.

While it was emptying, the computer locked up and restarted. The computer would not see the OS after and would not boot into safe mode. I had no choice to reinstall the OS.

Now all files from 2 internal and 2 external have disappeared. One was my audio drive and another was a timemachine back up my system and audio drives. One of the other two was a second backup of my audio drive.

Every audio file I've had for over 10 years gone!!!!!!!

How is it possible for every drive to be wiped?

I ran disk repair multiple times to no avail. I have one external drive at work running a disk utility app that is supposed to be the best, it finds some files that make no sense, but the total size of the files it finds is 300mb, the 4TB drive was at 70% full.

I am sick to my stomach.

Please help me if you can.

[Darryl Ramm]

How is it possible? Well maybe some of...

0. Your original system disk may have been faulty (often detectable by a disk verify) or the OS install on it corrupted in some way (not detectable by a disk verify) and it just crashed as a result when you emptied the trash (certainly not unheard of). I would run verify on the system disk multiple times going forward (e.g. at a day, week, month), and be cautious trusting it in general. What make/model drive was it?

1. Somebody accidentally deleted critical files causing the computer to crash when emptying the trash.

2. Somebody with sufficient privilages deleted the files on the other disks.

3. You have some malware on the computer. Unlikely -- but a good reason to not restore from backup the OS and applications even if you could.

4. When reinstalling OS X a mistake was made and the disks overwritten. (e.g. accidental start a format or restore to the wrong disk(s)).

5. Something is corrupted with OS X and filesystem mounts and maybe the files are still actually on the other disks.

For all these internal and external disks.... connected by what interface? HFS+ or what format? What exact make/model drives?

For external, take them to a separate Mac and connect them and see if anything shows up on the disk. Besides that stop trying to do any disk repair. You may need to get your check book out and find the best sounding local Mac repair/data recover service you can and describe what happened and have them look at your disks. Other folks here may be able to make recommendations.

What exactly had your son tried to install? A Minecraft Mod? What exact one/provide a link to it here.

---

Folks, you need to have backups and archives. Including copies that are not connected to the computer they are backing up (horrible risks there with physical theft, power supplies taking out multiple components, human error), copies not stored on-site and not all copies accessible to the same employees etc. DVD-ROM, tape (write protect the tape!) or external USB HDD are where I'd start for arching sessions. Make multiple copies and ideally use more than one media-type for session archives you care about. Maybe add some online storage to the mix as well. And check that what you have written is readable/works and actually can be restored on a test system or test disk.

[Drew Mazurek]

Sorry to hear it Barry. I have no help for you unfortunately.

I do know that if you're going to try the data recovery route, stop using/messing the drive immediately. It hinders the effort to get data off the drives.

[Obsidian Dragon]

Sorry to hear of this Barry. It does seem to be too much collateral damage from downloading a Minecraft related app. What is especially odd is the time machine drive being wiped too. I have a 12 year old and can testify that when he was 10, he could navigate everything on the computer and setup servers and networks to support his gaming needs. Very powerful indeed.

[Darryl Ramm]

Oh and I should have asked earlier. With all your drives connect them from a terminal window run both "mount" and "ls -l /Volumes" and paste the results here.

[Barry Johns]

I will try terminal when I get home.

The System drive is a 3 month old Samsung EVO SSD, the internals were WD 4th and WD 3TB.

The two external were Lacie D2's, one a 4TB and the other a 1TB.

The 4 TB Lacie was the time machine backup, with two partitions. One for backup of Time Machine which backs up the Audio Drive and the System Drive on the larger Partition. The other was backup for my Documents and Samples. The document and sample backup partition is in tact and working vine, the System/Audio backup partition retained its name, but that partition was wiped clean.

[Barry Johns]

Originally Posted by Drew Mazurek

Sorry to hear it Barry. I have no help for you unfortunately.

I do know that if you're going to try the data recovery route, stop using/messing the drive immediately. It hinders the effort to get data off the drives.

All my research says Data Recovery 3 was the best, so I bought that today for 100 bucks, but this is all I get from it. Anyone have any ideas from looking at this?

[Barry Johns]

Originally Posted by Barry Johns

All my research says Data Recovery 3 was the best, so I bought that today for 100 bucks, but this is all I get from it. Anyone have any ideas from looking at this?

Also note the size of the files, its less than 350mb total. The backups were at least 3tb total.

[Darryl Ramm]

If you are going to need to go the recovery route. I would pay a specialist service to do this for you. And I'd stop trying to do anything with the disk beyond basic standard mounting/unmounting etc.

Good recovery folks won't just fire up a utility on your disk(s) and start trying to do repairs, that may end up easily permanently losing your data. Especially if there is nothing physically wrong with the disk they'll do things like make a raw copy (using dd or simmilar) or the disk to another physical drive (identical drive helps), to a virtual disk or they'll do a raw copy to a virtual machine disk (e.g. VMware Fusion) and try to do any filesystem repairs/delete file recovery there. Or at a minimum if the raw disk is readable they should make raw copies of the disk (e.g. dd an image of that raw disk to a large file elsewhere) so they can put it back if stuck later. All specialized stuff but done in a way they can experiment/play around safely.

[Bill Denton]

Not much help now, but for everyone's future reference, it probably is not a good idea to drag a running installer to the trash and emptying the trash.

Don't know how it works on Macs, but I can see a lot of ways for disks to get scrambled on Windows machines...