My Mac just went back to factory settings, by itself and without warning

Sounds like your iCloud password may have been compromised, and someone logged into "find my iphone" and did "wipe my mac".

Do you use the same password for icloud (or your password recovery email account) as you do elsewhere on the web (worst case being forums that you have signed up to using your iCloud/mobile me address)? If so, then this isn't an apple problem, it is a "you are practicing unsafe computing" problem - and whilst getting your mac wiped is a symptom of this is it far and away not the worst thing that could be done.

I seriously doubt that your mac "wiped itself randomly".

Change your iCloud password and the password on your recovery email address (in case that was the email they logged into to get your icloud password via recovery) ASAP. Like... NOW.


If you don't want this to possibly happen, disable this feature:
http://mjtsai.com/blog/2012/08/04/find-my-mac-and-remote-wipe/

It may also be worth calling apple to see if someone else has pretended to be you, possibly via stolen credit card details, email address, etc to obtain log in to your accout.


And yes, if you don't have backups you don't care about your data....

Are you sure you didn't log in to a different user account? I would try to log out (Apple menu->Log Out), then make sure you select the correct user at the log in screen.

So you got hacked and it's Apple's fault? No, it's your fault. Go back to Linux.

Eipifi said:

Yes, I have a Time Machine backup from just a week ago.
...

Guys, make backups.

Click to expand...

More frequent than once a week would also be good advice.

Doesn't TM make hourly backups? At least the OP had a backup.

Eipifi said:

it loaded a fresh default desktop, default dock, default mouse settings, as if my OS account was just created. All the files in the home directory are gone, all the applications behaved as if I just installed them. OS just went back to factory settings.

All my documents, source code, videos, family photos (40.000 pictures, 10 years of shooting), were wiped out. Interestingly, my applications were still there (Firefox, Eclipse, Photoshop etc). But everything stored in the home folder (including ~/Library/Application Support/ and so on) were deleted. The bootcamp partition is intact.

Click to expand...

The most likely scenario is that all your user folders got moved away from their correct locations, and are hiding somewhere on the disk. But because they weren't where they should be, the computer acted as if the user account was brand new.

1. Check the size of the used space on the hard drive. Is it roughly the same as expected?
2. Check the /Users folder. Any other User accounts? In some versions of OS X, you could rename the user account, which would bring about this problem.
3. Can you search for the files in Spotlight?

Finally -- why wasn't TM plugged in for those 9 hours? If you have Lion or later, the computer saves backups to the hard drive, if the external isn't plugged in. So you might be able to recover those files.

Sorry, have to call BS on this one. As others have pointed out, TM does hourly backups. And as well, OSX doesn't just re-start itself. You either

a) somehow created and logged into a new account
2) it got remotely wiped by someone logging in to your icloud account

I can't believe 2 happened, as all of your apps are still there. A remote wipe kills everything.

So to sum up, either you are just bored and spreading FUD or you logged in to the wrong account. And if you are an actual Linux user, you would know how to log in to the correct account.

i just had the exact same thing happen to me. i was converting a movie in handbrake and the program closed and wouldn't reopen so i reset the computer. When i logged back in the same thing as the OP happened to me, my entire OS has gone back to factory. I have a TM backup so no major deal but it is really weird. My wife's account is untouched but mine was reset. i Have all my other apple products with me and I've received no emails saying that my apple id was used on another device. I have no idea why this happened but it is something apple should look into, and my iMac's only a week old too.

After many, many years working with PC Windows systems, I recently made the move to Mac. I purchased a 27-inch iMac with Retina 5K, which was delivered a week ago. I had read the books, watched the videos and started my set up of my new computer for my personal preferences. I imported all my email accounts and the next thing I was going to do was set up Time Machine before I brought in my working files. As I was sitting there drinking a cup of coffee and deleting old e-mails, I got a black screen and an error message. The computer turned off and upon restart got the same message seen too often on PC's, to send info regarding problem... After saying okay, I was brought back to the same screen I saw a week earlier when I took it out of the box. The iMac had reset itself back to factory settings. I immediately called Apple tech support and was wonderfully assisted(great to hear an American with no chatter in the background). He remotely logged on to my computer and checked the system files to try to find out what caused the reset. He was able to go into the, I think, "console" files and found no answer, as everything before the machine reset was gone. He agreed that the machine had been somehow reset to factory settings. Long and short, he was perplexed and had no idea how this could have happened. Yes, I was in the right user account(only one), and no, I don't feel my Apple ID was stolen. The tech spent about an hour with me and finally decided it was best to send the machine back and get a new one, due to only one week in possession. It was packed up yesterday and I am awaiting confirmation of receipt and shipping of a replacement.

Call me an Apple newbie, but don't call me a liar. I am not new to computers, just new to Apple computers. I have no ill feelings regarding Apple products, and just consider this a bump in the road. I am looking forward to my replacement iMac.

I just wanted to make this post to let you know that the subject matter of this post was experienced by me, and there was no explanation available by tech support. And yes, the first thing I am going to do when the new one arrives is set up the Time Machine. In my one week exposure to Mac OS El Capitan I was very impressed, but also learned that no computer is immune to failure by unknown means.

desertwest said:

In my one week exposure to Mac OS El Capitan I was very impressed, but also learned that no computer is immune to failure by unknown means.

Click to expand...

Well it took a bit of digging on duckduckgo but finally someone with the same inexplicable error - well almost the same. As per the OP I have all my Applications.

After leaving the iMac (mid 2010 2.8Ghz i5 El Capitan 10.11.2, rock solid box) off for 10 days while we were away, I came back, powered up and it boots into my admin account as usual. Next day my wife logs in to her account, which was fine before, and it asks for her iCloud password – looks like a new user is being created. She went through without logging in to iCloud and sees all stock new user settings, right down to the desktop wallpaper.

There are no old user folders in Shared (that was useful back in the day), indeed Shared is empty too which it wasn't before we left for 10 days. Where did it go? What about the 2 other guest accounts I've had set up for a few years? Gone!

To complicate things, my TM went down about a month ago (physical error, WD 2TB drive failed after 2 years) so I was in the process of moving everything over to a new SSD, but ran out of time getting everything working, so I reformatted it.

THANKFULLY I was running Disk Drill on my admin account which monitored the whole filesystem and is pulling her user account back from oblivion.
I'm obviously on borrowed time here so next step is to mirror that account back to the HD and then CCC the whole drive to the new SSD.

A very strange set of circumstances indeed. Next I'm getting a Carbonite account on top of a new TM.

I've been on Macs for about 22 years, I really like the Unix core of OSX but this latest glitch was diabolical.

Eipifi said:

It is going to sound strange and impossible, but it just happened to me about an hour ago.

After logging in to my account (typing my password) OSX started asking about iCloud settings. Then, it loaded a fresh default desktop, default dock, default mouse settings, as if my OS account was just created. All the files in the home directory are gone, all the applications behaved as if I just installed them. OS just went back to factory settings.

All my documents, source code, videos, family photos (40.000 pictures, 10 years of shooting), were wiped out. Interestingly, my applications were still there (Firefox, Eclipse, Photoshop etc). But everything stored in the home folder (including ~/Library/Application Support/ and so on) were deleted. The bootcamp partition is intact.


Yes, I have a Time Machine backup from just a week ago. I am in the process of restoring the system. So to sum things up, all I lost was 9 hours of restoring the OS.

Why am I writing this? To warn you.
WHAT THE ****, APPLE? HOW AM I SUPPOSED TO TRUST AN OS THAT CLEARS ITSELF RANDOMLY?

It was my first mac and this is my last one. I'm going back to my Debian.
Guys, make backups.

If anyone has any idea how this could happen, please share your thoughts.

Click to expand...

[doublepost=1453405002][/doublepost]Yes it also just happened to me. My Mac could to not even power on at first, and so I had to restart my power strip. When I did, everything was cleared. My mail, notes, calendar, bookmarks, documents, desktop, screensaver images folder, libra office documents, and desktop folders, photos, music files, & every password are now reset. Yesterday I had temporarily misplaced my iPod in another room, and used find my iMac, to locate it. Still at no time did I enter the wrong iCloud, or mac password, or authorize my mac to reset my iCloud or mac accounts. Unless someone who has access to my apartment, like maintenance tried to access my files, which I 'highly' doubt, why the heck would apple just reset my account. Also why did I not receive no email from apple, that my iCloud account, had been compromized. Yes I have backups, but what a a pain in the arse, restoring everything will be. This isn't the first time that this has occurred either. A very P/O'd apple user.

I was updating my Mac to the latest software and when I moved it out of the bedroom to finish the update, I accidentally unplugged the power supply, so it died while updating.. When I tried to login, it would let me login and then take me back to the login screen, over and over... So I held down the power button until it turned off, then released and pressed it again.. I think it's supposed to be in 'Recovery Mode'.. But, it started up like a brand new Mac and it's completely empty and back to default.. The only thing that makes me wonder if it's possible to save, is the fact that it says my hard drive is still full of content.. I'm no Mac expert, so if anyone is able to help me, please be specific.. Also, like an idiot, no time machine or backups...

Thank you to anyone who's willing and able to help..

James

Eipifi said:

It is going to sound strange and impossible, but it just happened to me about an hour ago.

After logging in to my account (typing my password) OSX started asking about iCloud settings. Then, it loaded a fresh default desktop, default dock, default mouse settings, as if my OS account was just created. All the files in the home directory are gone, all the applications behaved as if I just installed them. OS just went back to factory settings.

All my documents, source code, videos, family photos (40.000 pictures, 10 years of shooting), were wiped out. Interestingly, my applications were still there (Firefox, Eclipse, Photoshop etc). But everything stored in the home folder (including ~/Library/Application Support/ and so on) were deleted. The bootcamp partition is intact.


Yes, I have a Time Machine backup from just a week ago. I am in the process of restoring the system. So to sum things up, all I lost was 9 hours of restoring the OS.

Why am I writing this? To warn you.
WHAT THE ****, APPLE? HOW AM I SUPPOSED TO TRUST AN OS THAT CLEARS ITSELF RANDOMLY?

It was my first mac and this is my last one. I'm going back to my Debian.
Guys, make backups.

If anyone has any idea how this could happen, please share your thoughts.

Click to expand...

[doublepost=1477190325][/doublepost]I've just had exactly the same thing happen. I've owned my macbook air for 2 years and everything has been wiped. It has gone back to factory settings. How can I ever trust Apple again!!!!
[doublepost=1477190432][/doublepost]

throAU said:

Sounds like your iCloud password may have been compromised, and someone logged into "find my iphone" and did "wipe my mac".

Do you use the same password for icloud (or your password recovery email account) as you do elsewhere on the web (worst case being forums that you have signed up to using your iCloud/mobile me address)? If so, then this isn't an apple problem, it is a "you are practicing unsafe computing" problem - and whilst getting your mac wiped is a symptom of this is it far and away not the worst thing that could be done.

I seriously doubt that your mac "wiped itself randomly".

Change your iCloud password and the password on your recovery email address (in case that was the email they logged into to get your icloud password via recovery) ASAP. Like... NOW.


If you don't want this to possibly happen, disable this feature:
http://mjtsai.com/blog/2012/08/04/find-my-mac-and-remote-wipe/

It may also be worth calling apple to see if someone else has pretended to be you, possibly via stolen credit card details, email address, etc to obtain log in to your accout.


And yes, if you don't have backups you don't care about your data....

Click to expand...

[doublepost=1477190803][/doublepost]Neither I nor anyone else logged into "find my iphone" and did "wipe my mac". I closed my mac the night before, then turned it on the next morning and it'd gone back to factory settings. You may "seriously doubt that your mac wiped itself randomly", but I can assure you that is what happened. I don't use the same password for iCloud for anywhere else on the web, and am not as you suggested: "practicing unsafe computing".

Parisparee said:

[doublepost=1477190325][/doublepost]I've just had exactly the same thing happen. I've owned my macbook air for 2 years and everything has been wiped. It has gone back to factory settings. How can I ever trust Apple again!!!!
[doublepost=1477190432][/doublepost]
[doublepost=1477190803][/doublepost]Neither I nor anyone else logged into "find my iphone" and did "wipe my mac". I closed my mac the night before, then turned it on the next morning and it'd gone back to factory settings. You may "seriously doubt that your mac wiped itself randomly", but I can assure you that is what happened. I don't use the same password for iCloud for anywhere else on the web, and am not as you suggested: "practicing unsafe computing".

Click to expand...

My Macbook Air has just done the same thing. I powered it off a few days ago, switched it back on again and found that all of my documents, images etc had disappeared. All browsing history, cookies etc cleared and system needed to be set up again to my preferences. Having spoken to Apple, they were able to confirm that I hadn't been hacked and wiped as my applications are still there and chosen wallpaper etc. I logged in as myself and not a guest user also. Apple were not able to provide any explanation.