Hi all,

I was troubleshooting my mom's computer over the phone (she's got an 867 Quicksilver running 10.5 and Word '08, but the troubleshooting had to do with Time Machine), and asked her to save the Word docs she was working on and restart her computer.

When she returned to the desktop after restart, one of her documents was gone. She searched everywhere, according to her, but couldn't find it. I went over there yesterday to do a search, and when looking for the file, there was one error message saying a document with the same name was already open and the autosave doc couldn't be recovered.

My mom had re-downloaded the doc from June 1 from email (unedited version) and had it open. I renamed that one and the search turned up nothing.

The autosave cache revealed no such document. She did check the document I renamed but it was the unedited version.

My question after that long, drawn-out explanation is this:

Barring human error (this is more likely than I can possibly express to you), the bottom line is that this document my mom had spent a week on appears to be gone. Does anyone have any suggestions as to what I might be able to do to attempt recovery of this doc? (It wasn't in trash and she hadn't emptied it, and Word is on 5-minute autosave.)

Thanks for reading!

MJ

if time machine was set up why not use that to recover an older version?

If she got the doc in email and edited it from email, the most logical conclusion is this:

She received the doc in email. She clicked on it in her email. It opened in Word. She edited it. She hit Save, not Save As. It saved the document into a temporary folder, because it was opened from her email.

She restarted. The temporary folder was cleared out; the contents of some temp folders get wiped when the computer restarts. She looked for the file. She could not find it.

She downloaded it again. She clicked on it again. Now she just wiped the autosave version as well, because when you edit a file with a certain name, it will overwrite autosave files of the same name.

Had she not opened the file directly from email and then just hit Save rather than Save As, she would have been fine. Had she restarted, then looked for the autosave version of the file when she realized the original was gone, she would have been fine. By saving the file to the email temporary folder, then re-downloading it and re-opening it, she wiped the version she saved and the autosave version.

The moral: ALWAYS know where you are saving your files to!

Very plausible explanation! But, I guess, Word would have saved the open e-mail attachment in the Saved Attachments folder (home folder>documents>Microsoft user data). Will it really disappear from there upon restart? This is news to me. I often clear that folder because it accumulates attachments opened directly from e-mail and then just "saved".

I just tried an experiment, using Microsoft Word 2008 in OS X 10.5.8 (dunno if the versions make a difference).

Sometimes, the saved files end up in /library/Mail Downloads. Sometimes, they end up in /private/var/folders/-TMP-/com.apple.mail.drag. I can not find any rhyme or reason for the difference, except that it *might* be related to whether the doc is opened by double-clicking on it in Mail or dragging to the Microsoft Word icon in the Dock, and/or to the settings in the launch services database. It might also be related to permissions on the Mail Downloads folder, maybe. That's just speculation on my part; I'm not sure what the difference is.

/library/Mail Downloads will not be cleared on restart. The temp folder in /private/var will be.

Actually, you are right - when using Mail, it should go to Mail>downloads. I am using Entourage and it goes to the MS user data folder where it is safely kept.
And the troubling news for the OP is that the temp folder in /private/var must be invisible, right?

Yep, the /private folder (and everything in it) is invisible.

Remember that you can always see the invisible /private/var folder’s contents by using the Go to Folder feature of the Finder’s Go menu, and pasting in this pathname:

/private/var

Substituting /private/var/vm lets you see your virtual memory swapfiles, which of course you never touch.