Recover hidden files on a flash drive. Files are missing, what should I do? Files become invisible or hidden
We already know that there is a family of viruses that specialize in penetrating portable flash devices. , then we restored hidden folders and replaced files.
In this material we will talk about another type of virus that more seriously hides your data, in particular folders. The virus does not change the directory attributes, but renames the folder with prohibited characters, which makes the directory invisible to the system...
If you also find yourself in a similar situation, then it may well be that the Trojan.Radmin.13 virus (according to the classification) worked on the contents of your flash drive, which packed your folders and files into a folder invisible to the operating system with an original name consisting of two dots - " .. " In other words, the virus packed your data into a folder with a name consisting of characters that are prohibited in Windows.
How to recover missing folders on flash drives?
First, let’s clarify right away that not in all cases the folder can exist in this form; it is possible that the virus could delete the contents of the flash drive completely. In our case, folders can be restored, and this is evidenced by the displayed amount of occupied memory on the device.
Now in order:
- Login to the console command line. To do this, open the “Run” window using the keyboard shortcut Win + R
Type in the line – CMD and press Enter - In the command prompt window that appears, enter:
The letter of your flash drive, as it appears on the computer, and a colon, for example, F:
- Next, enter the command there:
dir /x /ad- dir – a command that displays all files and folders with subdirectories
- / x – parameter that displays short names for files whose names do not comply with the 8.3 standard
- /ad- an option that displays only a list of folders
- After running the command, you should have a folder called “E2E2~1", which indicates that it is thanks to the virus that your folders are invisible!
- type the following command:
ren E2E2~1 NEWF- ren (rename) - a command that allows you to rename both files and directories
- E2E2~1 - source directory
- NEWF - final directory
- start execution with the Enter key and close the command line window.
- Now all that remains is to check the result of the changes by opening the flash drive through Explorer or any other file manager.
Instead of an afterword
In most cases, such manipulations help resolve the problem with missing folders on a flash drive. But as I mentioned above, viruses never repeat their actions, so it is not a fact that this particular algorithm of actions will help you.
A new type of virus has appeared on the Internet that infects flash drives and external drives. I first encountered a similar virus about six months ago, when one of my clients had a similar virus hide all folders on flash drives and create shortcuts in their place. Since this was an isolated incident, I thought there was no need to worry and describe this problem. But very soon there were calls for help “help me recover data from a flash drive” and this virus turned out to be the cause of everything!
If you notice that folders on the flash drive have become shortcuts
Let's assume that you notice that when opening folders on flash drives, a system error occurs and only then does the folder open. See if the folders have a shortcut icon - it's a small arrow on the folder icon in the lower left corner.
If there are many or even all of these shortcut folders, then the system is probably infected with a virus, and your flash drive serves as its distributor.
Cleaning a flash drive from viruses
1. To search for and remove such a virus, I recommend using several antiviruses: first, do a full scan of your computer with the installed antivirus. In my case it is Avast (see Fig. 2). Scan the system drive C: and removable media, i.e. inserted flash drive.
If viruses are found, remove them. Of course, infected files from the Windows system folder must be handled carefully: treat it first or place it in quarantine. All others can be safely deleted.
2. Regardless of whether a virus was found or not, check the system with any other anti-virus utility. I recommend using CureIt. (http://www.freedrweb.com/download+cureit+free/).
Scan your system drive C and flash drive with this utility. Other logical drives can be scanned another time, otherwise removing a simple virus may take a long time.
3. After the system has been analyzed several times antivirus programs and maybe something was found, or maybe not, it’s time to move on to restoring hidden folders on the flash drive, and at the same time clean the flash drive of viruses that might not have been noticed by antivirus scanners.
How to show hidden files and folders on a flash drive
I’ll tell you in two words what’s going on here and why folders become hidden and invisible, and shortcuts take their place.
The logic of such a virus is simple, but at the same time extraordinary. Once on the flash drive through an infected computer, it registers itself in hidden folder RECYCLER , which is hidden using the Hide system attribute. It places an instance of malicious code (virus) under any name. This is how he camouflages himself. The virus assigns the “hidden and system” attribute to all files and folders that are on the flash drive, as a result of which they become invisible, i.e. hidden.
Then, the virus creates shortcuts to all hidden files and folders and makes them visible, substituting them instead of the originals. Not a bad idea, right?
As soon as you insert such an infected flash drive into your computer, open it and click on the shortcut folder, a system command will be triggered to launch the virus from the RECYCLER folder, and then to open the hidden original folder. If the antivirus does not respond to the virus, your computer will be infected and the consequences may vary: from stealing passwords to installing a backdoor to control your computer.
There are several options for how to remove a virus from a flash drive, and hidden files make visible:
- Using the command line
- Using a bootable Live DVD (or bootable USB flash drive)
- Using file managers ( Total Commander, Far, etc.)
Personally, I use it at work boot disk and a flash drive. But since this method requires a special disk or a special flash drive that needs to be mounted, it is a bit difficult for the average user.
So I will show you another easier way - using file manager Total Commander.
Restoring the previous appearance of folders on a flash drive
1. Go to the website http://www.ghisler.com/850_b15.php and download the 32+64-bit version of the program (Combined installer Windows 95 up to Windows 8, 32-bit AND 64-bit!).
2. Install it. Even if you already have a similar program installed, update it. Its icon will appear on the desktop (in some cases as many as two).
3. Open the program by clicking on its icon. In the program window, click on the launch button the required number(1, 2 or 3). This small inconvenience allows us to use this program for free.
4. In the left window of the program, select your flash drive from the drop-down list.
5. At first glance, everything is in order with the flash drive, the folders are in place, the files are just missing, but it only seems so. If you look carefully, you will notice that folders are shortcuts because they have the extension .Ink, but in fact folders do not have an extension.
Open the section In the settings window, select the Panel Contents section and on the right side, check the boxes next to the following parameters:
- Show system files
Now the picture has changed. Hidden system files were displayed (they may not even be system files, because they were simply given such an attribute).
6. Delete all shortcut folders with the Ink extension. To do this, hold down the CTRL key and select with the mouse necessary files. Press the DELETE key on your keyboard. Agree to deletion.
7. It remains to restore the previous appearance of the folders. To do this, it is enough to remove the “hidden, system, etc.” attributes from them. By standard means operating system Windows XP, 7 or 8 cannot do this, but using the Total Commander file manager it is easy.
Point (one-time click on the file with the left mouse button) to any file and select all folders and files using the keyboard shortcut CTRL+A.
Open the section. Remove all points opposite the values:
- Archival
- Read-only
- Hidden
- System
And click on the OK button. Now the files on the flash drive can be viewed using a simple Explorer.
8. One more small detail. All that remains is to delete the RECYCLER folder, which may contain the virus. Select the RECYCLER folder using the right mouse button and press the DELETE button on your keyboard. Agree to delete all files in this folder. If, when deleting, a warning appears that the file cannot be easily deleted, then select the “with administrator rights” button.
That's it! The virus will be removed and the files will be safely restored.
At the end of this review, I want to warn you in advance, if you suddenly notice that files have disappeared on the flash drive or, as in this example, shortcuts have appeared instead of folders and files, DO NOT HURRY TO FORMAT your flash drive! Try with this method return everything to its place.
Damage to important data on flash cards is not a rare occurrence and at the same time extremely unpleasant. We are accustomed to thinking that flash cards are a more reliable means of storing files than a computer or laptop, because they are more likely to break down and lose documents due to viruses and any other malware. However, flash cards are not protected against file loss; fortunately, they can be recovered.
Before you learn how to recover files from a damaged flash drive, you should first understand what causes the damage. Prevention is better than cure, moreover, this knowledge will help you learn more about how to repair a damaged flash drive.
Reasons for failure and loss of files from a flash drive:
These reasons are the most common, but in addition to them there are others, less common, such as wear of a flash drive. Repeated cycles of writing and reading, downloading and deleting can damage the flash drive. One way or another, you don’t have to worry about this, since it’s extremely difficult to use the drive until it wears out. There are more serious factors that worsen the condition of flash drives, these are increased temperature and humidity.
Recover accidentally deleted or damaged files
Unlike deleting documents from the computer desktop, when deleting documents from flash cards, they do not go into the trash, but are deleted permanently. You can recover such files using special program for USB data recovery.
Important! Remember what it is software restores only deleted files, which have not yet been overwritten.
To understand this, you need to know how a flash drive works. When you delete a file, it is not erased from the drive itself, but remains on it, but when you download new files, they take the place of the previous ones. Therefore, if you accidentally deleted important file, try not to use the flash card temporarily to avoid overwriting.
The same method is also suitable for recovering data lost after quick formatting or after unsuccessful copying. Like deletion, it does not erase data, but only makes it possible to overwrite it. Again - the sooner you start recovering, the more data you will be able to recover.
| Program | Description |
|---|---|
| Piriform Recuva | The main advantage of this program is the many ways it can be used. For users who feel like they need help using the software, there is a wizard on hand that provides scanning and recovery guidance. The program is available in two versions: free version Limited & Professional for $19.95 |
| Wise Data Recovery | Perhaps this is the most simple program in terms of its use. She doesn't have any hints on how to use them, she doesn't need them. To recover files you only need to take two simple steps |
| EaseUS Data Recovery | Finding recoverable data using EaseUS Data Recovery is very simple: select the disk that contained the lost or damaged file, run a scan and select from the found files those that you need to recover. It is important to note that the available free version of the program allows you to recover up to 2 GB of data |
| PhotoRec | PhotoRec is software designed exclusively for recovering lost documents. It is available in two versions: as a command line and as full-fledged program With graphical interface for less confident users. It is highly effective, but may not be as easy to use as other similar programs. PhotoRec is a cross-platform program that can also be launched from a flash card |
Recovering Files Using EaseUS
Step 1. Download and install the selected program; working with EaseUS will be considered as an example.
Note! Many of the programs presented above work on the same principle, so if you familiarize yourself with one of them, you will most likely cope with the others.
Step 2. Select a location to start searching for data. Launch EaseUS Data Recovery Wizard, select the place where your data was stored before deletion - on the flash card, and start scanning.
Step 3. To start scanning, click on the orange “Scan” button.
Step 4. View and recover lost files. EaseUS Data Recovery Wizard allows you to preview files before recovery. Click the "Recover" button to restore the file, or "Cancel" to cancel the process and close the preview window.
Note! After previewing and filtering your files, you can target the monitored files and click the Recover button to get all your files back.
Recovering files damaged by viruses
Damage to files on a flash drive can be caused by worms or Trojans. One of the common actions of malware is to hide files and folders, turning them into small shortcuts that cannot be opened.
To recover files you will need:
- Windows PC;
- an infected removable storage medium, i.e. a USB drive;
- antivirus and/or malware removal software;
- file search program;
Step 1. Check whether your files are hidden or not. First, open the command line application via search in the Start menu.
Then enter this command "attrib -h -r -s /s /d f: *. *" same as shown in the screenshot.
Enter the command attrib -h -r -s - s - d f- in the “Command Line” field, press “Enter”
Important! This command assumes that "f:" is the name of your flash drive. Don't forget to replace "f" if the letter the desired disk different.
Now press Enter and check if the files and folders are visible on your drive. If yes, then the problem is solved, if not, then go to the second step.
Step 2. Scan and remove malware.
Launch your security software. McAfee 2018 AntiVirus, Kaspersky or any other antivirus installed on your computer will work well. Open the program and do a thorough check hard drive your PC and flash drive.
Now check the items on your device, see if the shortcuts have disappeared. If yes, that's great. Otherwise, it is possible that a virus or malware has deleted your files. Go to Step 3.
Step 3. Data recovery and disk formatting. First of all, you will have to format the flash drive, that is, “delete” all files. There's nothing wrong with that. After formatting, you can restore them in the same way as with accidental formatting, which was discussed above.
Video - How to recover damaged files
People often ask me questions: files on the flash drive have disappeared, files on the flash drive have become invisible, or where did the files from the flash drive go? This cannot just happen, it is definitely the work of a virus on your computer or laptop. But now we won’t consider the issue of checking your computer for viruses; we need to access the files on the flash drive. Because Most often, you find out about your flash drive being infected on someone else’s computer, and you don’t often have to drag yourself back to the other end of town.
So, let's get started: First, we need to see the files. To do this, we must enable the display of hidden files and folders in the system where the flash drive is mounted. Let's go Start-Control Panel-Folder Options-tab View, scroll the list to the very end and in the group Hidden files and folders put the switch in position Show hidden files, folders and drives. More often than not, the virus declares its own and infected files as system files in order to complicate their removal, so it would be a good idea to uncheck the box located just above Hide protected system files (recommended), then click Apply And OK
Now we see absolutely all files on all media, both hidden and system. Now at least we can do something with them and work with them.
But our files are still invisible, and if we connect this flash drive to a computer that is configured by default, we will have to do everything described above again. This is of course not convenient, so we make the files on the flash drive visible. Now let's figure out why our files on the flash drive became invisible? Because the virus has assigned the attribute to all files and folders Hidden. Unfortunately, after the actions of the virus, it is not possible to simply uncheck the box in the file properties.
We need to change the attributes using the command line by typing in the command: go Start—Execute and dial cmd, press Enter or Start-Applications-Command Prompt
A black window will appear, in it we write the command: cd /d e:/ press Enter ( e- this is the letter of the flash drive, you may have a different one depending on the number of disks in the system) with this command we go to the root directory of the infected drive.
ATTENTION! The following command must be executed specifically for the selected media; if you run this command anywhere, then hidden files and folders will become visible anywhere, but we don’t need this.
We now have at the beginning of the line e:\> type the following command on this line attrib -s -h /d /s and press Enter. We wait a little and see that on our flash drive all the translucent folders have appeared.
If there are a lot of such flash drives or disks, then you can automate the process a little by writing it yourself or downloading from here.bat file with this team. The file name can be anything, for example, proyavitel.bat.
This file must be copied to the root and launched from exactly the drive that we want to display. Otherwise, as described above, we may accidentally make visible all the files on a drive that does not need it, for example, on the system drive.
Some users are faced with an unpleasant situation: the files that were on the flash drive disappear after connecting to the computer. If the user did not erase them himself, then there is only one conclusion - there is a virus on the flash drive that did not delete, but only hid the data. Information can be recovered in several ways.
Show hidden files
After detecting missing information, the first thing you need to do is configure the system to display hidden files.
Open the removable drive and see what data is now displayed on the flash drive. Most likely you will see shortcuts and unknown executable files of the virus.
Virus removal
After setting up the display, you need to remove the virus from the flash drive that hides the data. To scan the drive, use an installed antivirus or healing utilities such as Dr. Web Cure IT And Kaspersky Virus Removal Tool.
You can also clean the flash drive manually by removing unknown files with the *.exe extension and shortcuts from the media.
Data recovery
After setting up the system and removing the virus, you can begin to recover lost data. Typically, a virus simply changes the attributes of files, making them hidden. Your task is to restore the attributes to their original state or reset them completely so that the data is displayed in Windows Explorer. Let's try to restore attributes via the command line:
The process can be automated by creating a BAT file. Copy text like this into notepad:
echo Please wait...
attrib -s -h -r -a /s /d
Name text document view and save it with the extension *.bat - you get view.bat. Transfer the resulting file to the removable disk from which the data has disappeared. Launch the Bat file. After changing the attributes, the data that the virus allegedly deleted will be returned to the removable disk.
Working with FAT32
If the flash drive has file system FAT32, then the virus could go further and not only hide the data, but move it to the hidden directory E2E2~1. In this case, the procedure for restoring information after its loss will change slightly:
After completing these steps, the Folder folder will appear on the flash drive; it will contain the files that you were able to recover.
Recovering through file managers
If after working with the command line you could not recover the data on the flash drive, then try to find it through file managers. First use Total Commander:
If Total Commander does not help, use the Far Manager program to change attributes. It does not have such a user-friendly interface, but it performs its functions properly:
After disabling unnecessary attributes, the data in the file manager window will change color from dark blue to white. This means that the files are no longer hidden and you can open them on the flash drive.
Special utilities
Since the problem of missing files after a virus is quite common among users, there is special software that allows you to quickly recover information. 
