Mac Recovering .numbers file

[wellington]

Accidentally deleted a file that won’t be easy to recreate

Used diskdrill haven’t managed to find/recover

Would have been deleted this past Friday.

Any recommendations?

 

[aniglo22]

Did you check numbers autosave or temp files ? :~/Library/Containers/com.apple.iWork.Numbers/Data/Library/Autosave Information/

 

[mraleph]

Accidentally deleted a file that won’t be easy to recreate

Used diskdrill haven’t managed to find/recover

Would have been deleted this past Friday.

Any recommendations?

Assuming thay you don't have icloud backup, which file system is in question - APFS and in what directory the file was stored?

@aniglo22 replied with probable answer. You may recreate it from those fragments.

 

[wellington]

Did you check numbers autosave or temp files ? :~/Library/Containers/com.apple.iWork.Numbers/Data/Library/Autosave Information/

Yes, nothing there.

Assuming thay you don't have icloud backup, which file system is in question - APFS and in what directory the file was stored?

@aniglo22 replied with probable answer. You may recreate it from those fragments.

No, commercial information so kept a backup in secure storage, but that's infrequently synched (oops)

APFS and in what directory the file was stored?

In downloads (sub-folder).

You may recreate it from those fragments.

Did that once with a entire server -> wasn't fun, but better than nothing, having said that not finding fragments currently.

Weird how diskdrill sold as x to do y fails with it merely being a few days.

Am finding randomly created (numbers.numbers files) but can't open them in numbers.

 

[aniglo22]

Due to the nature of APFS a few days is too long . I don't think you have a chance with data recovery .

Am finding randomly created (numbers.numbers files) but can't open them in numbers.

What error do you get ?
Did you check recently deleted in numbers ?
There is a python library GitHub - masaccio/numbers-parser: Python module for parsing Apple Numbers .numbers files which parses numbers file and it also has debug scripts to get metadata and others which could help you to find the cause of corruption .

 

[wellington]

Thanks, i ended up re-building the sheet... tedious but fortunately had a backup till April to work from.

 

[0xDEADBEEF]

Good news: forensics on mac is not easy.
Bad news: this makes file recovery in cases like yours also difficult.

TRIM is enabled by default, which probably means it has already been overwritten and explains why your tools cannot find it:

system_profiler SPNVMeDataType | grep "TRIM"

 

[wellington]

Have to admit previously different Mac it was simple with ddrill

I’ve been debating buying a new one but unsure if buying one in country as this one appears to routinely have “student” operating and “classroom” x 2 in task manager

Came from the Apple Store

 

[aniglo22]

Have to admit previously different Mac it was simple with ddrill

I’ve been debating buying a new one but unsure if buying one in country as this one appears to routinely have “student” operating and “classroom” x 2 in task manager

Came from the Apple Store

profiles status -type enrollment

Can you run this command in the terminal ?
I suspect your mac is enrolled in MDM (Mobile-Device-Management) from a school/university .
Make sure to backup everything as MDM can remotely lock your device and wipe data .

 

[wellington]

profiles status -type enrollment

Can you run this command in the terminal ?

Did that previously, also tried to disable it a few ways.

Still runs time to time (at least twice a week) usually in the late evening when operating various servers in HK


Enrolled via DEP: No
MDM enrollment: No

Also

sudo profiles show -type enrollment

Error fetching Device Enrollment configuration: Client is not DEP enabled.

Make sure to backup everything as MDM can remotely lock your device and wipe data .

My main concern is watching the screen or logging the interactions as remote access into various servers daily.

Becomes rather tedious continuously having to watch for, whilst logging into the servers etc

 

[aniglo22]

Did that previously, also tried to disable it a few ways.

Still runs time to time (at least twice a week) usually in the late evening when operating various servers in HK


Enrolled via DEP: No
MDM enrollment: No

Also

sudo profiles show -type enrollment

Error fetching Device Enrollment configuration: Client is not DEP enabled.


My main concern is watching the screen or logging the interactions as remote access into various servers daily.

Becomes rather tedious continuously having to watch for, whilst logging into the servers etc

It's probably just an idle process .
Check if you have management active (System Settings > Privacy & Security > Management)
You can disable it's startup with:

sudo launchctl disable system/com.apple.classroom

And you would need to kill it if it's currently running .

Did you buy it used or new ?

 

[0xDEADBEEF]

Studentd doesn't run with elevated privileges, which reduces security risks. I've been monitoring it because you have mentioned it before, and haven't observed any suspicious activity. The custom alerts I set up haven't been triggered either. Just typical OS bloatware that you cannot remove without it reappearing after a system update.

If you are up for it, take a look at Asahi Linux.

 

[aniglo22]

Studentd doesn't run with elevated privileges, which reduces security risks. I've been monitoring it because you have mentioned it before, and haven't observed any suspicious activity. The custom alerts I set up haven't been triggered either. Just typical OS bloatware that you cannot remove without it reappearing after a system update.

If you are up for it, take a look at Asahi Linux.

Yeah I thought it was studentd , but I saw the screenshot later on . Studentd is just a daemon (studentd(8)) . You can just automate it with a bash script (but you would need to disable SIP , but you can enable it afterwards again ) to delete the bloat or move them into a directory .

 

[mraleph]

HP Zbook 15" w/ Microsoft Windows for specific software, similar use case w/ Apple MacBook and HP ZBook 17" w/ Linux - only the later is used

As it interests me, I replicated your case on a MacBook and attempting recovery. In your specific case, any further R/W should be aborted. Will follow up if successful.

Bloatware as it is, but it should be disabled after every controlled O/S update or a reboot; identify its PID and kill it

top | grep Class
sudo kill -9 $PID

Any significant intervention - data recovery included - on macOS requires that SIP (System integrity protection) is disabled as @aniglo22 pointed out. For that state, macOS must enter Recovery mode (reboot/shutdown, then press & hold command and R buttons). Once loged-in, type and execute in terminal

csrutil disable

and reboot to O/S. In order to permanently disable any MDM, enter terminal, type and execute in sequence

sudo su
rm -rf /var/db/ConfigurationProfiles/*
mkdir -p /var/db/ConfigurationProfiles/Settings
touch /var/db/ConfigurationProfiles/Settings/.profilesAreInstalled

SIP must be re-enabled, so reboot into Recovery mode, enter terminal - type and execute

csrutil enable

then reboot to O/S.

I hate macOS and Microsoft Windows But I wouldn't recommend that SIP is disabled on macOS apart during legitimate activities

Sorry for typos as I'm writting from the phone.

 

[wellington]

It's probably just an idle process .
Check if you have management active (System Settings > Privacy & Security > Management)
You can disable it's startup with:

sudo launchctl disable system/com.apple.classroom

And you would need to kill it if it's currently running .

Did you buy it used or new ?

Yeah brand new in the box from the store

FYI did that before - the process of killing it from starting up, still does it.

I’ll give this version a go thanks

 

[Houdini]

Can't you walk into a Mac store and get them help you with recovering your Mac ?

 

[brianK]

Accidentally deleted a file that won’t be easy to recreate

Used diskdrill haven’t managed to find/recover

Would have been deleted this past Friday.

Any recommendations?

How did this end for you, you had to buy a new Mac ?