Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Sabotage and trying to find my work

M

moodledoodle

macrumors newbie
Original poster
Jan 31, 2015
1
0
Hi guys

Wonder if anyone can help me?
An 'ex friend' managed to access my macbook pro from a position of mutual trust.
We are both in the same business and what this person then did was deleted all my work and then set off time machine running a fresh back up to make sure I could not restore this deleted work.:mad:
It has been done intentionally to sabotage me and ensure my business does not threaten this other individuals.

What I have since discovered is that the external HD I used for Time Machine backing up, which was also used by this person to back up fresh after their sabotage still has my original backup files in its trash.

What this person failed to remember is that you must delete the files from the trash whilst the HD is connected, if not they remain there and show up each time the HD is attached. :eek:

What I need to know now that I have discovered this is, is this my saving grace? Will my images, design files, etc be saved on the time machine back up I made two days prior to the sabotage that is sat there in the trash?

The file has the date of my backup and then folders as follows:
Macintosh HD
System
Library
CoreServices
boot.efi

I want to try and check if my work will be contained in this, however I am very anxious to do anything in case it affects my current files.
This and several other backups I made a few months ago are in the trash linked to my external HD.

Can anyone advise me how I can
a. access the backup correctly to view its contents
b. restore any files/documents that I may locate whilst doing a.

Many thanks
 
Fishrrman

Fishrrman

macrumors Penryn
Feb 20, 2009
28,327
12,450
In the future, I would suggest that you keep an "off-site" backup that is created by either CarbonCopyCloner or SuperDuper. If you had one of those right now, it would make recovery FAR easier.

But for now:

First, DON'T TOUCH the backup drive that you know to have your old TM backup on it, in the trash. Just disconnect it and let it sit for the moment.

Next, BUY ANOTHER EXTERNAL DRIVE. Get it initialized with Drive Setup.

Now, connect BOTH drives to the Mac.
Let both mount on the desktop.

Next, use CarbonCopyCloner to clone the contents of the external drive (the one that has the TM backup in the trash) to the NEW external drive. Now you have a "working copy".

Note, you can get CCC here:
http://www.bombich.com/download.html
CCC is FREE to download, and FREE to use for 30 days.

With the working copy made, disconnect the "first backup" drive and let it sit.

Now you can "go to work" on the working copy drive.
If you know that the old TM backup is "in the trash", try taking it out of the trash.
You'll have to be careful about WHICH TM backups you're manipulating.
I would try to get the old one out of the trash, and then delete the new (empty) one.

At that point, I would connect the drive with the recovered TM backup to the Mac, and attempt to restore from it by using Migration Assistant.

Can you get this far?

Advice - find new friends in the meantime.
Also -- sounds like you're in a business where "too much trust" ain't a good thing. Be governed accordingly.
Perhaps some kind of encryption on the Mac might be worthwhile (even though I'm not generally a fan of encrypting data)...

Hope this helps...
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom