Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: Urgent: Folder disappeared from external HDD  (Read 39719 times)

0 Members and 1 Guest are viewing this topic.

ThatGuy11200

    Topic Starter


    Rookie

    • Experience: Beginner
    • OS: Windows 8
    Re: Urgent: Folder disappeared from external HDD
    « Reply #30 on: February 01, 2015, 08:55:02 AM »
    Malware can and does hide data on a USB drive. This has been documented.. ** The OP may need to go to the virus  forum and get some needed help there.

    ** One one many references: http://www.v3.co.uk/v3-uk/the-frontline-blog/2253176/hidden-data-trick-could-be-malware-writers-boon

    I didn't try that at the time but it seems it would have been locked anyway.

    rohit_b



      Newbie

      • Experience: Experienced
      • OS: Mac OS
      Re: Urgent: Folder disappeared from external HDD
      « Reply #31 on: May 17, 2015, 04:41:46 AM »
      Hey,
      I have into exact similar situation. I had some 1.5 TB of pics in seagate 2 TB HDD. Yesterday while I was working on the photos al of a sudden the folder disappeared. I have initiated stellar phoenix scan and hoping for the best.
      Any idea why this happens?
      Regards
      Rohit

      Geek-9pm


        Mastermind
      • Geek After Dark
      • Thanked: 1026
        • Gekk9pm bnlog
      • Certifications: List
      • Computer: Specs
      • Experience: Expert
      • OS: Windows 10
      Re: Urgent: Folder disappeared from external HDD
      « Reply #32 on: May 17, 2015, 09:38:23 PM »
      rohit_b,
      You might have a different issue.
      It would be better to start your own thread.

      shawn_july



        Newbie

        • Experience: Familiar
        • OS: Windows 7
        Re: Urgent: Folder disappeared from external HDD
        « Reply #33 on: June 17, 2015, 03:38:48 AM »
        I'm facing similar situation on my 1TB ext HDD.

        The problem is not fixed but I just to share some of my findings.

        What causes this happen.
        1) Improper removal of USB drive, makes an error flag to marked on the drive/certain folder/files. Sometimes Windows just doesn't allow the disc to be removed, even with all program shutdown. We used to unplug it without shutting down the system, normally in assignment or emergency file transfer situation.
        2) Windows suggested to run a scan disc for the 2nd time you plug in the same drive.
        3) For this case, due to the folder was marked as error, Windows created a HIDDEN FOUND.XXX (numbers of 000, 001, 002) folder to moves all suspected error files into FILEXXXX.CHK.

        Due to the hidden folder, most users just able to see the HDD space being occupied but the files are missing. Showing all hidden and system files only do half of its work.

        We need something to revert the .CHK files back to things we need. I'm still trying with some softwares which I found on google. Few I used are not much helpful....

        I'm still working on some solutions.

        You may consider moving these .CHK file into a new good HDD before starting the revert work.

        BC_Programmer


          Mastermind
        • Typing is no substitute for thinking.
        • Thanked: 1140
          • Yes
          • Yes
          • BC-Programming.com
        • Certifications: List
        • Computer: Specs
        • Experience: Beginner
        • OS: Windows 11
        Re: Urgent: Folder disappeared from external HDD
        « Reply #34 on: June 17, 2015, 12:53:49 PM »
        Unfortunately, The .CHK files are practically useless. First you would need to identify which files they came from. Then you would need to identify where in that file they came from, and then you would have to slip them back into the file. They used to have limited utility when  dealing with the ancient CHKDSK program since if you were working with text-based documents you could often patch your file back together.. beyond that most people just started making backups on other floppies, though.

        the .CHK files are typically a single cluster (4K) and there can be multiple files from a single file. The data is from either clusters that were cross-linked (used by multiple files) or lost chains )(not associated with any file at all). In the first case, you cannot restore one of the files, since the cluster only has the data for one of the files that it was part of. For example if a text file and an executable somehow share a cluster, the last file to be written will be the "good" one. You might open a text file and see a bunch of garbage in the middle. So you delete it and rewrite that paragraph and save it. Later you run a program. it fails to start or crashes. Mystery? well, if it was cross-linked, you replaced part of the executable with text data. That executable data is gone, and you would need to reinstall the program.

        A lost chain is similar- it simply isn't used by any file on the disk. Major file corruption can disassociate clusters from files, but with NTFS this is far less of a problem. Typically these disassociated clusters, and even cross-linked clusters are a result of disconnecting an external drive that has write-caching enabled. By default any disk that looks like a Fixed Disk has write-caching enabled. You can verify write cache settings in Device Manager. eg:

        1. Right-click the Drive and choose properties
        2. On the hardware tab, identify the appropriate disk drive in the list that maps to the drive.
        3. Choose "Properties". This will open the Device Manager Properties.
        4. Select "Change Settings"
        5. In the "Policies" Tab, turn off "Enable Write-caching on this device". It's usually safe to use this for fixed, internal disks. For hot-swappable/USB devices you'll want this disabled, and a lot of external hard drives look like standard Fixed Disk Drives to the Operating System.

        You would need to identify the file it came from by looking at the 4K block and somehow "knowing" which file it came from, particularly since that data is now missing from the original file so you cannot search for it- then you would have to know where in the file it came from as well as how to patch it into place.
        I was trying to dereference Null Pointers before it was cool.

        harveybacon



          Newbie

          • Experience: Experienced
          • OS: Windows XP
          Re: Urgent: Folder disappeared from external HDD
          « Reply #35 on: June 20, 2015, 01:50:22 PM »
          This part worked for me:
          "Go to Control Panel->Appearance and Personalization->Folder Options
          In View tab, check show hidden file and also show protected system folders"

          Mine were in folder marked "found.000, found.001" etc. I just went into those folders and copy-pasted  into main folder. it will take an hour or so, but nothing else worked. Thanks!!!! I remember there being a disk check that happened and it must have chosen to erase what it saw as threats.

          ThatGuy11200

            Topic Starter


            Rookie

            • Experience: Beginner
            • OS: Windows 8
            Re: Urgent: Folder disappeared from external HDD
            « Reply #36 on: June 28, 2015, 01:54:53 PM »
            I've recovered the files now.

            I formatted the drive and used TestDisk to undelete them.