Been a while since I had anything to report, but this one is a doozy. I was called out to recover a lost Excel file, in which the client had entered data for three days, and then found the next morning that anything entered between 12/29 and 1/3 had vanished.
They thought they had mistakenly saved the file somewhere else, or under another name but could not find anything. To make the search even easier, there were only three Excel files on their drive. But everything was dated the 29th as the last changes made!
I entered TimeMachine and yep, every file ended at the 29th. I checked their SuperDuper backup as well, and the same thing was true. Each time, the typist had opened the file and the changes had been there, the 30th, the 31st, but on January 2nd when they came back to work, all the typing was gone.
This one beat me too. There was nothing to search for: no cache files (preserved usually only to recover from a crash) and no other temp files anywhere. Ready to throw up my hands, I went into Excel and looked under the Recent Items menu and there were two documents there, one on the cloned backup and one on the internal drive. But the path name in the menu was incomplete. The first part of the path was cut off.
Usually a path name shows where the file is, i.e.
Macintosh HD/Users/Home/Documents/Specific Folder/Name of the file.xls.
In this case, there were two looking like this:
.../Home/Documents/Specific Folder/Name of the file.xls
.../Home/Documents/Specific Folder/Name of the file.xls
There was no clue as to which was on the Macintosh HD and which was on Clone Backup. A bright, bold AHA lit up the room.
What the person had done was not go into the correct folder in Documents to open the file, but instead opened from the Recent Items menu under File in Excel. Most of us do this. But one time he accidentally chose the item on the Clone Backup drive, because the drive name did not show. That made it the more recent of the two, and put it above the one on Macintosh HD. Each further edit was done to the first item.
They did not catch the mistake on the second day because their SuperDuper backup was set to run only once a week, not daily as usual. So when it did run over the holiday, it dutifly cloned the internal drive to the external, overwriting the newer file on the backup drive with the one last opened Dec. 29th.
Of course TimeMachine was no help because it doesn't index clone-backup drives, just the internal. Hence, nothing newer than 12/29. In the 20 years I have been fixing Mac problems, this is the first time I have run into this. There was indeed no way to get the missing work back, but it gave ME fodder for this blog, and a warning to everyone: Be very careful when using the Recent Items menu. It's a lot safer to simply open the folder where your document is living and open it from there. No chance for a mistake like this to happen.
