Sunday, November 27, 2011

Find disappeared files and folders after Virus removal


The Vanishing folders problem


The Problem


The other day ,while moving stuff from a friend's PC onto an external hard drive I came across this peculiar problem. The external HDD got infected by a virus from the PC which was easily detected and removed by my antivirus but the real problem was that post virus removal , all the folders in the HDD vanished.
My immediate thought was that the virus must have erased all the data , but, as i was sitting there cursing my luck , something made me check the drive properties and sure enough all the space previously occupied by my folders was still occupied.


The Discovery


On realising that my data was still on the disk I started looking for ways to recover it.Instantly I noticed that on typing the address of the folder i was looking for directly into the explorer address bar , i could access the folder. For instance i was looking for a folder labelled 'Games' in my external drive ( I: drive ) so on typing 
I:\Games in the address bar i could access the folder ( pic below ).


how to get the folder to show
The Solution


What happens is that many viruses and worms change the attributes of files and folders to keep them hidden.Moreover they can also tamper with the folder options under Windows to prevent you from changing the attributes back. 
Even after removing the virus these attributes remain changed .


Now we come to the actual solution ( I tried this on Windows 7 ) :


Step 1 : Open the command prompt.
             In win7 you can do this by typing cmd in the search 
             bar in your start menu - the one at the bottom ,
             and hitting Enter .
             Alternatively go to Run ( you can press Windows + R 
             to do so ) and type cmd , then press Enter .


Step 2 :Type in the following command :


             attrib -H -S <the path to the folder>
             (disregard the < and > , obviously )


             for example :


             attrib -H -S I:\Games
             
             You can also use asterisks for multiple files/folders 
             and/or extensions
             
             for example :
             
             attrib -H -S I:\Games\*.*


             Hit Enter , and hey it's done ,your data is back !! 
             Give yourself a pat on the back.


sample


            
Let me know if this worked for you. 






1 comments:

Shamik Bose said...

Here's a better solution
Type "attrib -s -h -r D:\*.* /s /d"
Replace D: with the name of the drive and all your files will be restored.

Facebook Blogger Plugin: Bloggerized by AllBlogTools.com Enhanced by MyBloggerTricks.com

Post a Comment