HELP All files and settings suddenly gone!

[pposthoorn]

I was just organising my music in iTunes and suddenly it said it couldn't find the file of a song (that I just played a minute before). Next an settings message came up that I had to sign in to iCloud again, and then a message came up asking me if I wanted to also remove all user data of Steam. All my alarm bells went of, something is seriously messed up here.

I immediately turned off TimeMachine and WiFi as not to spread whatever is going on to the rest of the devices in my house.

I went in to Console to see if it would give me any lead on what was going on, but the only odd thing I saw was all sorts of messages about files that couldn't be found (which is to be expected if everything suddenly disappears).

I went to Finder and saw that all my user folders are empty except for Pictures. I thought maybe my Mac is having an off day so as a good computer user I tried turning it off and on again. When it booted I was presented the "Welcome to your Mac" setup process! I only had to do like two steps (sign in to iCloud and accept analytics stuff). Then I got back to my desktop and everything was as if I had just taken a new Mac out of the box.

First thing I did now was changing my Apple ID using my iPhone (maybe someone remote wiped my mac using iCloud or something. Although I didn't find anything suspicious there.)

I did some more looking around and found that most Apps where also removed, but not all (for example Microsoft Office is still there but MS Remote Desktop is gone. Dropbox is gone but GoPro studio is still here). All files from my mac are gone except for the contents of the Pictures folder and another folder I made myself in my user home folder (containing some software installers).

I did some searching on the web but didn't find anything similar to my case. I would really like to know what caused this, I do have some backups but if I don't know what caused this then I can't be sure it won't happen again...

I'm using a Retina Macbook Pro mid 2012 with the latest version of El Capitan.

Any help would be greatly appreciated.

 

[Gregg2]

I was just organising my music in iTunes and suddenly it said it couldn't find the file of a song (that I just played a minute before).

Do you know the action taken immediately before that?

 

[pposthoorn]

Do you know the action taken immediately before that?

I did this for about 15min, before that I think I was just browsing the internet with Safari (reading blogs and stuff).

 

[Gregg2]

I was just organising my music in iTunes and suddenly

Your answer didn't get to the point I'm asking about. Immediately before the message popped up, as in one millisecond before the message popped up, what had you just done? You searched for a song using the ____ command. or You dragged a file from one location to another. or.... What was the action you took that caused the error to pop up? Do you recall?

 

[pposthoorn]

I was manually removing duplicate songs from iTunes. I sorted all music by title name and then looked for double entries by looking at the artist.
When I found 2 identical songs I listened to the first song for about 10s, then to the second song for about 10s and then I wanted to listen to the first song again and then it was gone.

But I don't think iTunes had anything to do with causing this problem.

 

[pposthoorn]

Never found the issue (even after being on the phone with Apple Support for over an hour). Ended up doing a fresh install and put everything back to 5 days before using Migration Assistant.

Now the same **** happend! I got the Steam removing user data message again. I immediately saved my file I was working on and forced shutdown on my macbook by holding the power button.

I now rebooted it using safe mode (thank god it worked this time, last time it wouldn't boot to safe mode). And I found what I think is the start of the deletion of files in the console log files (I attached a piece of it in this message).

Is there anyone who can tell me what caused this? If I need to supply more info I can try to share the log file somewhere (is there anything sensitive/private in the logs that I should be aware of before putting it on the web?)

Jan 21 15:56:25 rMBP-Perry ReportCrash[70547]: Saved crash report for ApplicationManager[70573] version 1.1 (1.1.33) to /Users/Perry/Library/Logs/DiagnosticReports/ApplicationManager_2016-01-21-15562 5-3_rMBP-Perry-2.crash
Jan 21 15:56:25 rMBP-Perry ApplicationManager[70567]: Started (v1.1.33)
Jan 21 15:56:26 rMBP-Perry iconservicesagent[446]: Failed to get the real path for: /var/folders/nm/pks56lgs4hxcr_lqvv8ptr0h0000gn/C/com.apple.iconservices
Jan 21 15:56:26 rMBP-Perry WindowServer[205]: send_datagram_available_ping: pid 709 failed to act on a ping it dequeued before timing out.
Jan 21 15:56:26 rMBP-Perry defaults[70607]: The domain/default pair of (kCFPreferencesAnyApplication, NSAutomaticWindowAnimationsEnabled) does not exist
Jan 21 15:56:26 rMBP-Perry Safari[70578]: CFPropertyListCreateFromXMLData(): Old-style plist parser: missing semicolon in dictionary on line 3. Parsing will be abandoned. Break on _CFPropertyListMissingSemicolon to debug.
Jan 21 15:56:26 --- last message repeated 3 times ---
Jan 21 15:56:26 rMBP-Perry Safari[70578]: KeychainGetICDPStatus: keychain: -25300
Jan 21 15:56:26 rMBP-Perry Safari[70578]: KeychainGetICDPStatus: status: off
Jan 21 15:56:27 rMBP-Perry Safari[70578]: CFPropertyListCreateFromXMLData(): Old-style plist parser: missing semicolon in dictionary on line 3. Parsing will be abandoned. Break on _CFPropertyListMissingSemicolon to debug.
Jan 21 15:56:27 --- last message repeated 7 times ---
Jan 21 15:56:27 rMBP-Perry lsd[397]: LaunchServices: Could not store lsd-identifiers file at /private/var/db/lsd/com.apple.lsdschemes.plist
Jan 21 15:56:27 rMBP-Perry Safari[70578]: CFPropertyListCreateFromXMLData(): Old-style plist parser: missing semicolon in dictionary on line 3. Parsing will be abandoned. Break on _CFPropertyListMissingSemicolon to debug.
Jan 21 15:56:28 --- last message repeated 3 times ---
Jan 21 15:56:28 rMBP-Perry com.apple.Safari.SearchHelper[70616]: Failed to obtain sandbox extension for path=/Users/Perry/Library/Caches/com.apple.Safari.SearchHelper. Errno:1
Jan 21 15:56:28 --- last message repeated 1 time ---
Jan 21 15:56:28 rMBP-Perry com.apple.SecurityServer[85]: Session 100669 created
Jan 21 15:56:28 rMBP-Perry sandboxd[140] ([70616]): com.apple.Safari(70616) deny file-issue-extension /Users/Perry/Library/Caches/com.apple.Safari.SearchHelper
Jan 21 15:56:28 --- last message repeated 1 time ---
Jan 21 15:56:28 rMBP-Perry Safari[70578]: Caching encoded userInfo to use until we are marked dirty again (UAUserActivity.m #1567)
Jan 21 15:56:28 rMBP-Perry Safari[70578]: Returning cached encoded userInfo (UAUserActivity.m #1508)
Jan 21 15:56:29 rMBP-Perry Safari[70578]: CFPropertyListCreateFromXMLData(): Old-style plist parser: missing semicolon in dictionary on line 3. Parsing will be abandoned. Break on _CFPropertyListMissingSemicolon to debug.
Jan 21 15:56:34 --- last message repeated 19 times ---
Jan 21 15:56:34 rMBP-Perry lsd[208]: LaunchServices: Could not store lsd-identifiers file at /private/var/db/lsd/com.apple.lsdschemes.plist
Jan 21 15:56:34 --- last message repeated 1 time ---
Jan 21 15:56:34 rMBP-Perry kernel[0]: Sandbox: rm(70611) System Policy: deny(1) file-write-unlink /Applications/App Store.app/Contents/Info.plist
Jan 21 15:56:34 rMBP-Perry kernel[0]: Sandbox: rm(70611) System Policy: deny(1) file-write-unlink /Applications/App Store.app/Contents/MacOS/App Store
Jan 21 15:56:34 rMBP-Perry kernel[0]: Sandbox: rm(70611) System Policy: deny(1) file-write-unlink /Applications/App Store.app/Contents/MacOS
Jan 21 15:56:34 rMBP-Perry kernel[0]: Sandbox: rm(70611) System Policy: deny(1) file-write-unlink /Applications/App Store.app/Contents/PkgInfo
Jan 21 15:56:34 rMBP-Perry kernel[0]: Sandbox: rm(70611) System Policy: deny(1) file-write-unlink /Applications/App Store.app/Contents/PlugIns/DockTile.docktileplugin/Contents/_CodeSignature/Code Resources

 

[Gregg2]

Do you Shut Down and Restart your Mac from time to time? If so, since this occurred?
If not, try that first.

Your crash report looks like it might be a kernel panic, but I'm not sure. If it is, this could be a sign that your hard drive is failing. How old is the computer?

 

[pposthoorn]

Hey Gregg, thanks for the reply but you are not quite on the right track there. I restart my system from time to time. The deleting of files stopped after I shut it down (as expected).
I can see the files actually being deleted so it's also not a hard drive issue.


I contacted Apple again today and this time the rep told me it's a 'known issue'. He told me it is probably a 3rd party app and by taking a specific action or by pressing a certain combination of keys this behavior is triggered. They don't know what app it is and couldn't (or wouldn't) help me find out. Because it's not apple software they don't want to give support on this issue, quite disappointing...

Is there someone who wants to help me dig trough the Log files to find out what application is causing this?

 

[antman2x2]

This is actually super interesting. Im of no help, but please keep us updated with your findings.

 

[Gregg2]

Hey Gregg, thanks for the reply but you are not quite on the right track there. I restart my system from time to time. The deleting of files stopped after I shut it down (as expected).
I can see the files actually being deleted so it's also not a hard drive issue.

Well, I always try the simple things first. Too bad this is not easily solved.

I contacted Apple again today and this time the rep told me it's a 'known issue'. He told me it is probably a 3rd party app and by taking a specific action or by pressing a certain combination of keys this behavior is triggered. They don't know what app it is and couldn't (or wouldn't) help me find out. Because it's not apple software they don't want to give support on this issue, quite disappointing...

I feel for you. Wish I had enough knowledge to suggest other things to try. You need a Mac tech to respond, I know they're on the forum.

 

[KoolAid-Drink]

Try doing a full re-install, but don't migrate data over this time using the Migration Assistant/post-installer OOBE. Instead, 100% do a new install, then copy stuff over from the contained Time Machine backup. Be sure to put down your Office product keys first, though!