record of all pdfs saved in safari?

[cfstrock]

Hi I'm new to this macrumors community but I was wondering if anyone might be able to help me with this issue- I tried to save a webpage in safari as a pdf by hitting "command p", then "save as pdf". I attempted to save this to an external hard drive. Upon closing safari and clearing my search history in safari, I realized the document that I thought I saved as a pdf was not on the external hard drive. Any chance of retrieving this document which I thought I saved? Was it ever even saved at all? Upon trying to replicate my actions to see where I may have gone wrong, I noticed an error message flash across the screen after I hit save reading "error while printing".

Im running Safari Version 10.1 (12603.1.30.0.34) on a Macbook pro with OS Sierra version 10.12.4 I did have time machine running.

Document lost was the private key to a bitcoin paper wallet so any information that leads to the recovery of this document will be rewarded. Any help would be greatly appreciated! Thank you in advance for your time and help!

 

[BrianBaughn]

If it was saved properly and you didn't change the name of the PDF then it would have likely been given the name of the particular web page printed.

 

[cfstrock]

Thanks Brian, but I believe the issue here is that it did not save properly and I'm wondering if there is any record of it stored in my Library somewhere that I can access with timemachine or through my terminal? Perhaps some other record of files that safari attempted to save?
[doublepost=1511194192][/doublepost]To give some more background, the document I'm trying to recover is a private key for a bitcoin paper wallet I generated using bitaddress.org. To generate the private key for the paper wallet securely, I save the bitaddress.org webpage to my desktop, disconnect my laptop from the internet, then generate the private key while the computer is offline, save the private key to my external HD then clear my history and delete all records of the key before turning my internet back on. Issue was, I moved finances onto the newly generated wallet without double checking that the key was saved as a pdf on my external before I deleted everything. I will reward anyone who can help me resolve this with some bitcoin. Thank you again for your help.

 

[organicCPU]

The Time Machine could hold it. Locate some recent ~/Library/Safari/History.db in your TM.
As that's an SQLite DB you could inspect the file with e.g. DB Browser for SQLite.
Search the history_items table.
Good Luck!

EDIT: Or search through TM archives of ~/Library/Caches/com.apple.Safari/WebKitCache/Version 10/Blobs and ~/Library/Caches/com.apple.Safari/WebKitCache/Version 10/Records/ respectively ~/Library/Caches/com.apple.Safari/fsCachedData

 

[cfstrock]

Thanks for your suggestion organicCPU, but unfortunately it did not work for my purposes- Yes I can see URLs of websites visited but I think the only way to get the info I'm looking for would be if there is some log of the pdfs that were saved or attempted to be saved on safari. bitaddress.org is visible in the DB but that all that is available is the URL. Because the private keys for bitcoin wallets are generated randomly every time the webpage is opened, I would need the access the specific page in the format it was in at the time I tried to save it to get the information I am looking for. From scouring the internet, I'm not sure it is possible...

 

[kohlson]

Have you tried:
- In a Finder window, clicking in the left nav, in All My Files, then sort by date. in my experience All My Files is less than reliable, and it was replaced by Recents. Use Command-J to set parameters.
- Easyfind, or similar. It is very capable.

 

[cfstrock]

Thanks for advice kohlson, but neither date sorting in finder nor Easyfind had and luck recovering from my mac HD nor my external HD. I believe that the file was never actually saved...

 

[organicCPU]

Finding a file with suffix pdf on every attached and mounted device from a particular day can also be done in Terminal:

sudo find / -iname "*.pdf" -type f -newermt 2017-11-20

The problem is that the file probably was never written for whatever reason.
That's why I suggested searching all the files that Safari generated while surfing, not only pdf files.
I don't know exactly how Bitcoin wallet transfer at bitaddress.org communicates with the browser.
Therefore I suggested searching History.db in the hope that your key could be found in a specifically unique generated URI. Searching through the various locations of Safari caches (see EDIT of my last post) wasn't meant to come up with a PDF, but maybe with a rendered image file or some text string that shows the key you're searching for. Regular expression search might help you searching in file contents if you can describe the pattern of the key.

If that all doesn't help, there is another layer of digital forensics analysis. Those might be investigating the RAM content or the hard disk drive buffer. Maybe someone here in the forum can share practical advice, how to do this or if it makes sense in this case. I think it's like finding the needle in a haystack and the plenty of security mechanisms introduced by Apple and the fact that much of these informational bits have a fading nature will even make it harder. Maybe it's a good idea to contact a digital forensics expert, if it's worth that much. Maybe it's another good idea to make a snapshot copy of the contents in /private/var/vm folder for such kind of actions. For the future I think it's best to make a hard copy print or note of such important documents. However, good luck finding that needle...

 

[cfstrock]

Thanks organicCPU, I definitely appreciate all of your excellent advice. I tried everything you suggested and still have come up with nothing, perhaps a digital forensics expert is something I should be looking into. In addition to Time Machine, I copied my /private/var/vm folder to a drive for further investigation. If you know of anyone who would be interested in this, please have them message me. You are correct though, a hard copy of these things is certainly necessary and it was my intention to print off a hard copy, I was just a little too hasty in making this new wallet.

 

[organicCPU]

Unfortunately I don't know anyone with those abilities. With some fortune someone will find this thread or better do a web search for digital forensic colleges or organisations nearby your location. Professional data recovery services could be able to help as well. Probably you should stop using the Mac ASAP. I hope it's not too late at this point and we didn't destroy the needle in haystack with our endeavor.

Alternatively you could make a block level copy of the whole internal Mac drive from another Mac in Target Disk Mode with ddrescue or some other tool just before more data will get overwritten and lost (I think the vm folder content is not enough). Then pass the resulting disk image file to an expert or try inspecting deleted files (probably your Safari cache files that will have different names, but probably its dates are correct) by yourself with PhotoRec or some commercial tool. If you're not sure how to do all this without more impact on the drive (consider at least Time Machine, Spotlight, DiskArbitrator), better pass the Mac to the pro in the first place.

 

[Fishrrman]

OP:
Hope you had a backup.
If not... time to learn about such things!