Sparse image file secure trash deleted

P

powerbookg42002

Registered
DELETION STORY:
I was trying to clear out space on my HD (because I was getting disc almost full messages)for some reason and I don’t have a lot of files on my G5 because I don’t trust it (it was a lemon from the start). I prefer my old G4. I downloaded something called Directory X , free software that shows you all the files on your HD and how much space they use.
I immediately saw a ?sparse image file that was 55G and this file was not familiar (never saw before). So at the time, I didn’t know what the sparse image actually was. Because it is always invisible with File Vault and I enabled File Vault last year and forgot about it. The only reason it was visible now is because of this free software that I downloaded. Maybe the creators of Directory X should warn people about File Vault File images. I right clicked the file and it said ‘blank”. I remember creating a file in disc utility for encryption a few months ago but never dragged any files into it so I thought this must be that file especially since it said blank. I deleted it and proceeded to delete some other files that appeared safe to delete. My HD didn't show any more free space, so I secure trash deleted. Within minutes, I got a hunch that I should interrupt the deletion but it wouldn’t let me I guess because it was in use. I’m not sure. So I powered off the computer and I could not log back into my user account.

This was ultra stupid, but so is the option of using File Vault without having to be certified in the program. I would prefer this type of software be for purchase rather than part of system preferences because at least I would understand and know what it was all about before deciding to use it.

Anyways I had tons of PDF scanned documents, etc.

Any chance of recovery? How could my entire home folder be deleted within 10 minutes. I had to do a hard reset because the trash would not stop and I was afraid of deleting some other files after I started the the process. (I think the sparse image was already deleted). Would I be able to still navigate my files until I logged out if the sparse image file was actually deleted completely?
Thank you! I'm sick about this but I'm not sure if there is any hope. Thank you very much, Kate
 
powerbookg42002 said:
I would prefer this type of software be for purchase rather than part of system preferences because at least I would understand and know what it was all about before deciding to use it.
Click to expand...

Secure erase and an encrypted sparse bundle image on top of that! I honestly don't think the NSA could even get that data back. I do data recoveries all the time for customers and I don't think I or any other data recovery service could touch that. I understand you are frustrated, but its not Apples fault. That's like popping the hood on your car while its running and sticking your hand in the fan blade and severely injuring yourself and blaming the maker of the car for not protecting you from yourself.
 
You wouldn't happen to have a recent backup of your system? This would be one of those situations when it could save a lot of work and hassle.
(Once we get the system running properly for you, time to set up a backup system, e.g. with Time Machine if you've got 10.5. It will help at least for any future data loss disasters).

The folder would have been deleted even in less time (in under a second) if you would have done some command line acrobatics with rm command in Terminal, and without passing thru the Trash at all. Not that it helps much, but at least compared to rm there is a reasonable chance to recover at least something.

And yes, it would help if there were reasonable warnings, and if Directory X was smart enough to know that at least SOME of the sparse images are Filevault files, so it would not hurt if it had a warning for this type of images. I'm sure that you are not the only person to whom something like this has happened. It really sucks when it happens.

Satcomer's alternatives are good for trying the file recovery.
There are also some professional file recovery services, e.g. Drivesavers.com, but those services tend to be a bit pricy for personal use (it can be $ hundreds).
I hope that you can recover the lost contents.
Please use the G5 until the file recovery attempts - the less the affected system's hard drie is used since the data loss, the better the chances of getting the data back.
 
Thanks, I stopped using the drive immediately. I have been reading a lot and I think I may have deleted a sparse image that was "Blank" that I created a few months ago. I'm thinking the reason filevault crashed is because I did a hard reset while emptying the trash. And from what I read, this is a no, no.
 
I understand however File Vault is only an option for the very experienced mac user and should be advertised as such.
I have read post after post and have spoken to over 3-4 mac certified engineer's and they have all told me they Never, Ever use File Vault. Their exact words are "Never use it". It is way to risky and I could have lost my information a dozen other ways with File Vault: 1. updating my system to snow Leopard, etc 2. A power outage can take All of your information if you have File Vault enabled if it did not power down correctly. 3. If your computer does not shut down properly & you do a hard reset. And this list is not complete. For what it's worth I think It crashed from the hard reset while emptying regular files. Not sure if it's a better scenario or not.
 
It should come with the appropriate warnings. For many of us who've been here (and using Macs for many years), it can seem evident or more clear that it has its limitations, and one should be very careful, but it's just wrong to assume everyone knows those limitations or that they'd have been using the system for years. And some who've used Macs for more than a decade and filevault for years still fail to recognize what the sparse image is.

Other things, apart of the ones you've now discovered from the technicians, would include for instance running out of space. The sparseimage grows but does not shrink that easily. You could save some space back by turning filevault off, but to do that you need at least as much space as the filevault image takes. If you have 200 GB of usable space on your computer, of which let's say 40 GB is used by other things than your home folder, 90 GB by your filevault home folder... you can't turn filevault off.

Some things to do instead of using filevault that are just good practice for security (it's a bit out of the original topic, but to clear away from filevault in the future needs some considerations):
1. Disable automatic login. This in on by default - now if you have filevault on, and your system logs you in after a reboot, what do you gain for security? Nothing.
2. Preferably, set the login so that user needs to type username and password, not to pick from the list. Short username works logging in too, but if anyone that shouldn't be at your computer tries to log in, it's a bit harder.
3. Set up Open Firmware password. (for Intel Macs, there's a tool for setting this if I remember correctly, on the install disc that came with the Mac)
With that set, if anyone would try to simply reset the password, they're out of luck.
(Open Firmware password can be reset, but not even all Apple authorized service providers know how to do this. If any customer asks for this to be done, they need a proof of ownership).
4. Protect the Mac physically. I.e. no access to outsiders, and when traveling don't advertise in the bag that you've got a Mac
5. Set up the system to require password when waking from sleep. (good hint for any cat owners too - the 'catsloc' has saved my systems from many walks on the keyboard to do any damage)
6. If some files need to be encrypted, you can encrypt the specific files (e.g. Disk Utility can do this - create a new disk image, set it to be encrypted, and drag files in that image). But you still need a backup, and securing the access to the backup remains the weakest link for those files.
 
Great information. I have read numerous posts regarding problems with turning file vault
off because they no longer have enough space to do so. Here's yet another thing I just learned this week. When you change your user password..... you better remember the old one that file vault was enabled with because the passwords do not sync automatically.
Now if you purchased your mac recently (unlike mine 4 an 9 years ago), your ps may sync automatically but only if you have the latest operating system.
 
You must log in or register to reply here.
Back
Top