How I can recover files when the folder shows empty but the files are not deleted?
Some malware will set certain file attributes to hide your files. It could be in order to pretend they're the files themselves, or could be just to cause distress. The files could be affected with the Hidden attribute (you can see them with the "show hidden files" in folder options, and unset them in the properties sheet) or the System attribute (makes them hidden unless "show protected system files" is checked in folder options).
How to get rid of the attributes
The easiest way is to remove the attribute from all files in the system. This does not affect normal Windows operation, but might make visible files that you really shouldn't be touching, such as pagefile.sys
or boot.ini
.
- Open an elevated command prompt (Start->Programs->Accessories->Command Prompt, right click, "Run as Administrator"). If you don't have UAC enabled, just run a regular
cmd
as an administrator user. - Run
attrib -H -R -S C:\* /S /D
. ReplaceC:\*
with the drive letter you want to fix.-H
unsets the Hidden attribute;-R
unsets the Read-only attribute (which some malware also set);-S
unsets the System attribute./S
makes it recursive,/D
makes it apply to folders as well. - Remember that when specifying an entire drive, you must put the
\
after the:
, otherwise MS-DOS quirks kick in and it doesn't actually apply to the entire drive. Theattrib
command also doesn't seem to like to work in the root folder directly, so the*
is needed, but not when working on any other folder.
The less nuclear option is to give a more specific path to the attrib
command, such as attrib -H -R -S "C:\path to\folder" /S /D
.
In case of 'attrib' is not recognized as a...
It's possible that your %PATH%
environment variable is messed up. You can try giving the full path to attrib
by calling it as %windir%\system32\attrib
. If this still doesn't work, then even the %windir%
variable got messed up; just replace it with the path to your windows installation directory, almost always C:\Windows
. In the worst case that the tool is not available at all, you need to do a repair install of Windows.
Try Recuva. Download the portable version using another computer and run it from a USB drive. These guys also make everyone's favorite: CCleaner.
My USB drive and folders were affected by a virus, and I couldn't retrieve my data. The drive's file size was showing as 653MB. I recovered all my data with the help of a PowerISO virtual drive.
Just select the drive or folder that you want to recover (the drive/folder may seem empty, but it still contains data) and make an image file. Open that image file with the same software and copy the files that you want from the image file.