A bunch of seemingly random files disappeared from my Mac
Summary: I just discovered that a lot of files were removed from my personal Mac two months ago. There is seemingly no pattern to which files are missing, except that no folders got deleted and only directories synched to iCloud Drive were affected. I suspect some software or misconfiguration to be at fault here, but I can't pin it down.
I first discovered this three weeks ago when some slides for a past lecture were gone. I was sceptical, since the empty folder was still there, but I let it go. A few days later I noticed more files missing and when I tell you my heart dropped. I sat down and went through all directories and sure enough, about 20% of my filesystem is gone.
Using my backups I was able to gather a lot of information about the affected files, and I can tell from the last modified date of affected folders that the files were removed on 10.01.2021 at around 2:00 am. Here is what I found out:
Affected Files:
There is no pattern regarding the file itself. Affected files are of every possible type (TXT, PDF, DOCX, PAGES, JPEG, MP4), file names are not related (no special characters etc.), creation and modification dates range from December to 4 years ago. Sizes range from >2 GB MP4's to 0 byte txt-files.
Affected Folders:
No folders were deleted. Files only went missing from random subfolders of Documents, which is synched to iCloud Drive.
Interesting Edge Cases:
In most cases all files in a specific folder are missing. But there are some edge cases which highlight the randomness of the deletion. The following folder contains scans of my old school reports, where 6 of 11 files are gone. Notice how types, names, sizes and dates are almost identical (there is also 1 Schulnachricht missing):
Folder containing all files before deletion:
The same folder after 10.01.2021:
This is a similar case involving slides from a previous lecture, were 7 out of 9 PDFs were removed:
Folder containing all files before deletion:
The same folder after 10.01.2021:
My Setup:
I am using a 2018 13-inch MacBook Pro running Big Sur 11.2.1 (20D74). This machine is backed up to a Time Capsule using Time Machine. I also use a PC running Windows 10 (20H2) which is synched to iCloud Drive. I realise that the files also could have been deleted on my PC and my Mac synched the changes. I will go down that rabbit hole when I can rule out the Mac as the cause. I am the only user of those devices and nobody else has physical access to them.
Even though I can restore all the missing files I noticed through the backups, I definitely need to investigate the cause of this event. Please throw any ideas you have at me, I am happy to look into every one of them!
Update:
While restoring my file system from the backup today, a possible cause came to mind. I might have enabled and, after a few days, disabled optimise Mac storage. Maybe this operation screwed up massively and only left small files behind, which is how my Documents folder shrank from 39 to 2 GB.
You have identified the probable cause. From Apple:
When space is needed, it keeps files, photos and videos, Apple TV movies and shows, and email attachments in iCloud and makes them available on demand. Files don’t take up space on your Mac, and you can download the original files when you need them.