Mac Recovering .numbers file

[wellington]

Accidentally deleted a file that won't be easy to recreate

Used diskdrill haven't managed to find/recover

Would have been deleted this past Friday.

Any recommendations?

 

[aniglo22]

Did you check numbers autosave or temp files ? :~/Library/Containers/com.apple.iWork.Numbers/Data/Library/Autosave Information/

 

[mraleph]

wellington said:
Accidentally deleted a file that won't be easy to recreate

Used diskdrill haven't managed to find/recover

Would have been deleted this past Friday.

Any recommendations?
Click to expand...

Assuming thay you don't have icloud backup, which file system is in question - APFS and in what directory the file was stored?

@aniglo22 replied with probable answer. You may recreate it from those fragments.

 

[wellington]

aniglo22 said:
Did you check numbers autosave or temp files ? :~/Library/Containers/com.apple.iWork.Numbers/Data/Library/Autosave Information/
Click to expand...

Yes, nothing there.

mraleph said:
Assuming thay you don't have icloud backup, which file system is in question - APFS and in what directory the file was stored?

@aniglo22 replied with probable answer. You may recreate it from those fragments.
Click to expand...

No, commercial information so kept a backup in secure storage, but that's infrequently synched (oops)

mraleph said:
APFS and in what directory the file was stored?
Click to expand...

In downloads (sub-folder).

mraleph said:
You may recreate it from those fragments.
Click to expand...

Did that once with a entire server -> wasn't fun, but better than nothing, having said that not finding fragments currently.

Weird how diskdrill sold as x to do y fails with it merely being a few days.

Am finding randomly created (numbers.numbers files) but can't open them in numbers.

 

[aniglo22]

Due to the nature of APFS a few days is too long . I don't think you have a chance with data recovery .

Am finding randomly created (numbers.numbers files) but can't open them in numbers.
Click to expand...

What error do you get ?
Did you check recently deleted in numbers ?
There is a python library GitHub - masaccio/numbers-parser: Python module for parsing Apple Numbers .numbers files which parses numbers file and it also has debug scripts to get metadata and others which could help you to find the cause of corruption .

 

[wellington]

Thanks, i ended up re-building the sheet... tedious but fortunately had a backup till April to work from.

 

[0xDEADBEEF]

Good news: forensics on mac is not easy.
Bad news: this makes file recovery in cases like yours also difficult.

TRIM is enabled by default, which probably means it has already been overwritten and explains why your tools cannot find it:

Bash:
system_profiler SPNVMeDataType | grep "TRIM"

 

[wellington]

Have to admit previously different Mac it was simple with ddrill

I've been debating buying a new one but unsure if buying one in country as this one appears to routinely have “student” operating and “classroom” x 2 in task manager

Came from the Apple Store

 

[aniglo22]

wellington said:
Have to admit previously different Mac it was simple with ddrill

I've been debating buying a new one but unsure if buying one in country as this one appears to routinely have “student” operating and “classroom” x 2 in task manager

Came from the Apple Store
Click to expand...

Code:
profiles status -type enrollment
Can you run this command in the terminal ?
I suspect your mac is enrolled in MDM (Mobile-Device-Management) from a school/university .
Make sure to backup everything as MDM can remotely lock your device and wipe data .

Last edited: Sep 23, 2024

 

[wellington]

aniglo22 said:
Code:
profiles status -type enrollment
Can you run this command in the terminal ?
Click to expand...

Did that previously, also tried to disable it a few ways.

Still runs time to time (at least twice a week) usually in the late evening when operating various servers in HK


Enrolled via DEP: No
MDM enrollment: No

Also

sudo profiles show -type enrollment

Error fetching Device Enrollment configuration: Client is not DEP enabled.

aniglo22 said:
Make sure to backup everything as MDM can remotely lock your device and wipe data .
Click to expand...

My main concern is watching the screen or logging the interactions as remote access into various servers daily.

Becomes rather tedious continuously having to watch for, whilst logging into the servers etc

Attachments​

• 
  1.webp
  28.2 KB · Views: 70

Last edited: Sep 23, 2024

 

[aniglo22]

wellington said:
Did that previously, also tried to disable it a few ways.

Still runs time to time (at least twice a week) usually in the late evening when operating various servers in HK


Enrolled via DEP: No
MDM enrollment: No

Also

sudo profiles show -type enrollment

Error fetching Device Enrollment configuration: Client is not DEP enabled.


My main concern is watching the screen or logging the interactions as remote access into various servers daily.

Becomes rather tedious continuously having to watch for, whilst logging into the servers etc
Click to expand...

It's probably just an idle process .
Check if you have management active (System Settings > Privacy & Security > Management)
You can disable it's startup with:
Code:
sudo launchctl disable system/com.apple.classroom
And you would need to kill it if it's currently running .

Did you buy it used or new ?

 

[0xDEADBEEF]

Studentd doesn't run with elevated privileges, which reduces security risks. I've been monitoring it because you have mentioned it before, and haven't observed any suspicious activity. The custom alerts I set up haven't been triggered either. Just typical OS bloatware that you cannot remove without it reappearing after a system update.

If you are up for it, take a look at Asahi Linux.

 

[aniglo22]

0xDEADBEEF said:
Studentd doesn't run with elevated privileges, which reduces security risks. I've been monitoring it because you have mentioned it before, and haven't observed any suspicious activity. The custom alerts I set up haven't been triggered either. Just typical OS bloatware that you cannot remove without it reappearing after a system update.

If you are up for it, take a look at Asahi Linux.
Click to expand...

Yeah I thought it was studentd , but I saw the screenshot later on . Studentd is just a daemon (studentd(8)) . You can just automate it with a bash script (but you would need to disable SIP , but you can enable it afterwards again ) to delete the bloat or move them into a directory .

Last edited: Sep 23, 2024

 

[mraleph]

HP Zbook 15" w/ Microsoft Windows for specific software, similar use case w/ Apple MacBook and HP ZBook 17" w/ Linux - only the later is used 🙄

As it interests me, I replicated your case on a MacBook and attempting recovery. In your specific case, any further R/W should be aborted. Will follow up if successful.

Bloatware as it is, but it should be disabled after every controlled O/S update or a reboot; identify its PID and kill it

Bash:

top | grep Class
sudo kill -9 $PID

Any significant intervention - data recovery included - on macOS requires that SIP (System integrity protection) is disabled as @aniglo22 pointed out. For that state, macOS must enter Recovery mode (reboot/shutdown, then press & hold command and R buttons). Once loged-in, type and execute in terminal

Bash:
csrutil disable

and reboot to O/S. In order to permanently disable any MDM, enter terminal, type and execute in sequence

Bash:

sudo su
rm -rf /var/db/ConfigurationProfiles/*
mkdir -p /var/db/ConfigurationProfiles/Settings
touch /var/db/ConfigurationProfiles/Settings/.profilesAreInstalled

SIP must be re-enabled, so reboot into Recovery mode, enter terminal - type and execute

Bash:
csrutil enable

then reboot to O/S.

I hate macOS and Microsoft Windows ns2 But I wouldn't recommend that SIP is disabled on macOS apart during legitimate activities 🙄

Sorry for typos as I'm writting from the phone.

Last edited: Sep 23, 2024

 

[wellington]

aniglo22 said:
It's probably just an idle process .
Check if you have management active (System Settings > Privacy & Security > Management)
You can disable it's startup with:
Code:
sudo launchctl disable system/com.apple.classroom
And you would need to kill it if it's currently running .

Did you buy it used or new ?
Click to expand...

Yeah brand new in the box from the store

FYI did that before - the process of killing it from starting up, still does it.

I'll give this version a go thanks

 

[Houdini]

Can't you walk into a Mac store and get them help you with recovering your Mac ?

 

[brianK]

wellington said:
Accidentally deleted a file that won't be easy to recreate

Used diskdrill haven't managed to find/recover

Would have been deleted this past Friday.

Any recommendations?
Click to expand...

How did this end for you, you had to buy a new Mac ?

Toggle signature
Winners never quit and quitters never win....