Two missing files. Where did they go?

I’m wondering if anyone can help here.
One of my colleagues has lost two rather important files. They are Word docx files.
They were both modified in the last week of December.
Both files have vanished and we can’t find them.
Neither file is in the Time-Machine. There are two Separate Time Machine drives and both come up blank for these two files.
We have searched as thoroughly as we can using titles, content and dates both in the hard-drive and the back-ups to no avail.
They are not in the bin, older material is, so it’s not likely that they have been accidentally deleted.
I have looked through every folder on the internal drive (a tedious job) and still come up blank.
We know some of the content and have used it to search - but nothing!
No cloud services are used so the files must be somewhere on the Mac (New iMac in September and fully up-to-date).
I’ve read that there are command-line ways or searching, but I don’t know anything about it.
So, can anyone help?
It will be extremely difficult (and in some respects virtually impossible) to recreate these files as there are very many dates that are vital but impossible to remember.
It’s all to do with licensing agreements with publishing houses.

There is another issue but I’ll post that tomorrow.
Thanks

Ok, it sounds like you have done a really thorough job of looking for them, so, the answer is possibly either really tough or you two have overlooked some basic assumption (this trips me up so I try to keep it in mind, but it’s hard). My bonkers thought is, since it seems that the files are not on that Mac at all (since you were thorough)… could your colleague have actually done the work on a different Mac? (Bonkers, I know, but you’ve covered all of the basics, unless there is one thing we’ve overlooked, the “basic assumption” issue.) (I am also hoping others chime in with better ideas.) (You tried Word’s “open recent”? Did your colleague create the files from new, or were they emailed and maybe they edited the email version? [I don’t know all the ramifications there.])

2 Likes

If your colleague has OneDrive (1TB storage is included with a Microsoft 365 account) or if your company uses Microsoft SharePoint, then perhaps he saved the documents there.

MS Office can open files stored on OneDrive/SharePoint without mounting the shared file system. If there is no local copy, then Time Machine wouldn’t see anything to back up.

6 Likes

From the command line:

cd /
sudo grep -rail "a string in the missing file"

I would first find a reasonably obscure string in a file you know is not missing, and verify that it works as expected.

It can take quite a while, as it must scan the content of every file, but it doesn’t depend on Spotlight databases or the like (which can be remarkably incomplete at times).

3 Likes

.docx files are stored as zip-compressed archives, so I don’t think grep can parse them even with the -a flag.

Might still be worth a try on the off chance that they’re not actually saved as .docx

1 Like

You’re right; I overlooked the .docx bit. It might still be worth using find to search for the file name:

sudo find / | grep -i '\.docx$' >docxfiles.txt

should find all the .docx files on the drive and write a list to docxfiles.txt. I’m on a Linux machine right now so I can’t test if this works exactly the same on macOS, but it should. You can then use your favorite text editor to look through docxfiles.txt to see if you can find the vanished files.

Again, this will bypass a lot of the limitations of Spotlight. You’ll see a lot of error messages (mostly “Permission denied” or the like) but it might find the files if they got stuck somewhere obscure or missed getting indexed.

Have you tried any of the commercial search utilities? EasyFind, free from Devon Technologies, has a very comprehensive set of search parameters. https://www.devontechnologies.com/apps/freeware

4 Likes

The possibilities here include:

  • You were not editing the file where you thought you were
  • You were, but the file has since been deleted or moved
  • The file is now invisible
  • Something else

For the first possibility, the cloud locations are a possible reason, but you said there’s no cloud apps involved. I’ve also seen people have this problem when they modify a file by opening an email attachment; the file is actually buried in wherever the email system stores the attachments. This is worse with Outlook on Windows, as the file is in a really obscure place.

A file can become invisible if it is renamed to start with a period (“.”), which can happen if you’re trying to rename it and mistype. It also can vanish if it is being synched by Dropbox and the filename has characters that aren’t valid on the operating system. It might even happen, maybe, if it has characters that the Finder doesn’t like.

I too would suggest using a utility that does a more thorough search. I’m partial to Thomas Templemann’s Find Any File. You can search for all .docx, or .docx last modified in a window, or any other criteria. If that doesn’t find it, hold the option key when you click Find, to get it to search as the root, so it can look in more places.

2 Likes

Like others, and assuming you have been thorough, I think cloud storage is the most likely explanation. Microsoft apps (assuming MS Word was used) love to store documents in MS’s cloud. So I would be looking in whatever MS cloud service they were using (knowingly or not) at the time.

1 Like

If the edits are recent there might be Microsoft temporary files still on the Mac that could be a way to recover the original.
See these tips:

Thanks to everyone for their thoughtful replies,

I’m not seeing Jay until the middle of next week so I’ll report back as to how we get on.
Something else that bothers me though is why is there no record of this file in any Time-Machine back-up.
The two files were created many years ago to track these licences. They get modified at least once a month as licences expire or get extended. They have gone through several versions of Word and several migrations unscathed.
There isn’t a single copy of either file in any back-up.
If I look at a back-up from a month ago, a year ago or even two years ago, they are not there.
It’s as if the ‘Delete all back-ups of this file’ command has been used, but that’s very unlikely . knowing Jay. Especially as there are 2 backup drives.

As I said earlier, There is another issue, It’s Time-Machine related but I don’t have time to post it now.
Again, thanks to all.

1 Like

You might also want to double check if the file/folder has been excluded from Time Machine backups.

Word updates two property lists when you open a document, both in ~/Library/Containers/com.microsoft.Word/Data/Library/Preferences: com.microsoft.Word.plist and com.microsoft.Word.securebookmarks.plist. Note that the Container may appear as “Microsoft Word” in Finder windows, but it really is com.microsoft.Word. (I consider this to be a bug.)

The entries in these plists last a lot longer than what’s in Word’s Recently used lists. Years longer.

Open the .plists in a text editor and search for the missing files. Note that the file name may be encoded, for example following the rules for URLs. For example, a file named Toss & Turn would be Toss%20&%20Turn. So search for parts of the file name.

Your goal is that if you can find the files in the .plist, it will reveal the exact path of where that file was when it was last opened.

If the files are not in the current version of the .plists, try looking for the same .plist in the Time Machine backup, closer to when the documents were last edited.

3 Likes

Again, Thanks everyone.
Now making an emergency visit in the morning as Jay phoned to say that two more files that she worked on yesterday have also disappeared.

I’ve used HoudahSpot to find files. It does an excellent job of finding data. You can enter some text to search anywhere on the drive and it will find it in a file, so if the file has been renamed you can still find it, though the command line examples should have found the data if it exists. I’d try some tests with Word on some sample files to see if it has a problem saving files. Perhaps there is some disk corruption too?

Might it be worth thinking carefully about what has changed since the files were last seen? For example, has Word been updated, has the OS been updated, … ?

Following that thought a bit further: you say the files are not in the TM backups, but have you tried reverting your whole system back to - say - December when the files were last seen?

Are the newly disappeared files also .docx? If they are then it strongly suggests (to me) that Word is saving them somewhere different. What do the Word prefs say about where to store files?

I would second using FAF; it is an excellent utility. I also wondered if it could be be possible that your files are on your icloud drive… mebbe…

Some good thoughts here. Two that strike me are using a different user account (a stretch) or that the file became invisible. The search for invisible files (those that start with a period “.”), try this command:

find . -type f -name ‘.*’ -print | grep docx

The first “.” represents your current working directory. I’d start with my home directory and then expand the search. If you use “/” instead of “.”, you’ll start at the root directory.

A more brute force method might be to search for all word documents and then sort them by date last modified and just look through the list.

I may have missed this, but I assumed that you checked Word’s “Recent” dialog (not the “Recent Items” in the menu bar. – but the Recent sidebar that appears in the Open dialog when you choose Open… from the menu bar) ? It tells you where it thinks the document is stored. It will provide a clear indication on whether the document is on OneDrive or a local disk (with the folder location).

In recent Microsoft 365 updates, the default file location is OneDrive. If that’s the case, unless you have the OneDrive client on your Mac you won’t see the documents in your local file system.

It’s worse than that—Autosave now will only save to OneDrive, not to local. Which I think is beyond ridiculous. I have zero need to save any documents to OneDrive, ever. I have never used that part of Office 365. But I can’t autosave Word or Excel files to my local filesystem, only to OneDrive.