Q I started transferring files from my iMac running OS X 10.6.8 to an encrypted memory stick, when the process stalled. I then noticed each file on my Desktop disappearing one by one, until all the files in my Home Folder vanished, my email address book has been wiped, and links to email accounts have gone too. Is this a virus or a problem with the new memory stick?

A Checking the logs that you sent reveals that some hours after these file disappeared, an app identifying itself as com.yourcompany.SecureLock was still trying to delete files from your Desktop using the Unix command rm which does not work through the normal Trash, but removes the files immediately.

This seems to be the tool which performs encryption on memory sticks supplied by Integral Memory through various retailers: its FAQ is here.

In the absence of a detailed account of exactly what happened at the time, it is hard to be sure what has gone wrong. If you had opted to move (not copy) the files onto the stick, it is possible that the SecureLock tool assumed that the files had been encrypted and copied across, so started to delete the originals.

Alternatively in the heat of the moment the stick may have been removed from its USB port, or you tried to delete files on the stick or your hard disk, causing the software to misbehave and start shredding your Home Folder. There is no evidence that your Mac has been affected by malware, although you should always be alert to that, of course.

You can list the files remaining, but possibly hidden, on your Desktop by opening Terminal and typing
ls -la Desktop
there. If the files have gone from there and are not on the stick, then they are most likely gone for good, although some may be recoverable using a disk recovery tool.

Macs do not support a fully encrypted file system; FileVault uses neat tricks with encrypted disk images to mimic an encrypted file system. Thus third party encryption software used in this setting is likely to encrypt files on your hard disk, then copy the encrypted files over to the stick, deleting copies on your hard disk. If this process malfunctions it could end up removing other files. This is an issue that you should take up with the retailer that sold you the stick.

Comments Encrypting files containing sensitive data when moving them on removable media is one way of ensuring that they remain secure, in compliance with the Data Protection Act. However encryption is also a good way to lose data if you are not very careful, and do not use a robust and proven workflow and tools.

Although Disk Utility’s encrypted disk images are not as neat as this type of turnkey solution, provided that you do not forget the password, they are fairly bombproof, and should normally be the first choice for a Mac user.

Updated from the original, which was first published in MacUser volume 29 issue 11, 2013.