How to: Recover hidden files infected by viruses

Almost every new technology has its own threat. Nowadays most of us use USB flash drive to transfer files between devices especially computer or PC. Some of us couldn’t care less the risk of the files being infected by viruses when transferring (which involves the process of copy/paste) files between two (2) of the devices. One of the most common consequences of doing so is the files couldn’t be found (hidden) inside the flash drive. So don’t get panic. Here is a tip and steps to recover the files hidden in your flash drive.

1. Plug in ur thumb drive into the USB port.

2. Just after the computer detects the flash drive, open My Computer (or u can simply press “Windows + E” keys together) and identify the drive letter for the flash drive. In this example the drive letter for the flash drive is ‘E’. You might be able to see some or all the files and/or folders are transparent (this is actually the hidden files/folders). In case of u didn’t see any files, no need to worry because it is due to the explorer setting which restrict the user from viewing the hidden files. You might be able to see it later once the process is complete.

3. Next, click on windows START button then click ‘RUN’ and u’ll get a run window like the image displayed below. Type ‘cmd’ in the textbox given then press ‘OK’ button.

4. Inside the new window (this is actually MS-DOS prompt), type the drive letter for the flash drive followed by colon ‘:’. In this example our drive letter for the flash drive is ‘E’. Therefore, type ‘e:’ then press ‘enter’ key. Next, type “attrib –s –h *.* /S /D”. Wait until u see ‘E:\>’ prompt again just after the command we have type before. (Please be patient since the process of recovering hidden files might take few moments depends on the number of files/folders in the flash drive.)

5. Once the process completed, open My Computer again and Whoalaa!! :O the hidden files will appear in ur flash drive again.. :) Have a try.. :D

About these ads

About sirmart

Assalamualaikum and thanks for dropping by. I'm just a simple person who love to simplify everything i'm capable of in my own ways. Interest in gadgets especially related with any IT based product. Work as a full time lecturer in college located at Cheras, Kuala Lumpur. Born in Seremban, N. Sembilan (den oghang nogogri). UiTM diploma graduated (1998-2001) and OUM degree graduated (2006-2009).
This entry was posted in Computer Tips and tagged , . Bookmark the permalink.

79 Responses to How to: Recover hidden files infected by viruses

  1. mas says:

    but mart,this solution never make the virus go away rite ;)

  2. sirmart says:

    yeah.. :D forgot to mention that u need to scan and remove all the viruses before proceed to the above steps. Or else, the files might hidden (disappear) again in later.

  3. mas says:

    hee.. dah tau dah.. saje je ;) happy blogging!

  4. cikcloudy says:

    assalamualaikum sirmart..
    what if i cant open d files due to the access privileges ? the thing is, i reformatted my laptop then the whole files cannot be opened.. it says user does not have access privileges. it people at my office ponnn tatau nak wat camner.. adoilaaa… pls help..

  5. sirmart says:

    W’salam.. Did u install any encryption software in the laptop previously? According to ur statement, it might occur due to two(2) reason:

    1. The the file inside the flash drive have been encrypted using s/ware from ur laptop before u format it.
    OR
    2. You or someone else have modified the access level for the flash drive.

    Try this steps:
    1. Once u insert the flash drive into the PC, right click on it drive letter and select properties.
    2. Next, click on ‘Security’ tab and u’ll see a list of user and permission.
    3. U need to modify the permission for all user so that they can freely modified the file.

    If these steps doesn’t works, it might due to the content inside flash drive have been encrypt using the s/ware from ur laptop before u format. In case of it is true, u need to install the encryption s/ware again in order to read the file again.

  6. Anne says:

    Thanks SirMart! It works!!!
    I have recovered the hidden files back to its original state.
    But I just moved the virus to my virus vault, will this still affect my computer?

  7. Muhammad Ali says:

    My name is Muhammad Ali and i really like to thank you. I used your method for (How to: Recover hidden files infected by viruses) to recover all of my files from my WD Passport Essential External hard disk successfully. You are really doing a great work. Just in case I am leaving the nature of my problem below; for Technical Reference which i posted on different forums. THANKS AGAIN.

    Hello,
    I have a 320GB Western Digital Passport Essential USB 3.0/2.0 mass storage device with approx 72 GB of data on it, and I have been using it without problems for several months. Now recently I connected it on my friend’s computer to copy some data. When I got back and plugged it in, in my computer all the previous data of 60 GB including its smartware becomes translucent as hidden except the newly copied data of 12 GB. After that when I connected the disk second time all the previously translucent data is gone except the newly copied data which remains intact. I can’t see the old data anymore not even in the status bar as hidden items nor access it. But the drive properties shows 72GB for Used space and rest for empty space. What happened to the old data I stored on the drive? Is there another way to access the data on the drive? Thanking you in anticipation & will be greatly appreciated!

    • sirmart says:

      Im glad that it help u to recover the missing files.. :) itwould be my pleasure to help others in need since im also encounter the same problem before.. Thanks for ur appreciation.. :D

  8. I have followed the instructions according to the steps given in order for me to retrieve the hidden files in my USB device but the response i get is that “Access denied -F:\System Volume Information”, so please help me get over this hitch before I render your services invalid. Many people have come out of such troubles I hear due to your valuable IT skills and knowledge that you freely share with individuals around the world. I would be grateful to you if my request would receive active attention soon.

    • sirmart says:

      According to the error “Access denied -F:\System Volume Information” u received, i believe that u r using windows vista or later operating system. Try this out:

      1. Click Start button, then on “search programs or file” field type ‘cmd’ but DONT press enter.
      2. You will get a list of result, on top of it is program “cmd.exe”, right click on it and select “Run as administrator” and when being asked, press ‘YES’.
      3. Next follow the instruction no. (4) from my post.

  9. Robin says:

    HI Sirmart…
    I have a USB and all my data are missing, I’d like to recover them because I have no other way to find them and they are useful for my life.How will I do?I tried USB Show and it only has shown some folders and the most important of my files are zipped winrar files…Please help me am scared to lose them

    • sirmart says:

      Dear Robin, have u tried all the steps in my blog? Files from any removable drive might lost due to circumstances. It might lost due to virus effection or the broken physical drive it self. All the procedures i mention in my blog only able to recover files “hidden” by virus. There are virues that capable to permanently delete some/all the files. If that is the case, im sorry all the steps cannot be used and beyond my knowledge to recover it. If u had a bad/broken physical drive due to not properly remove it the drive from PC, u might try to google “file recovery” software. Some of them are free. Hope my response does help u to find the solution.. :)

  10. shafiqsulong says:

    salam. i.ve tried those step but it appear ” acces denied – F:\system volume information”.
    please help me.tq.=)

  11. Aasish says:

    Wow Thanks Buddy it really Works

  12. Paulo says:

    Wow! Thanks sir! It’s really works 100%. Thanks a Lot!

  13. Mhedz says:

    Hi Hello! I need your help so badly, I just inserted my flash drive to the lap tap and surprisingly noticed that the drive has been modified to different language. I cannot even open all the files. I followed the instructions listed above but it goes for naught. Please, help. Thanks.

    • sirmart says:

      Hi there..
      Sorry to hear that.. My guide only covered the files hidden due to virus activity. In your case, the files might be recovered by installing and run anti-virus software. Its depends on luck bcoz not every corrupted files can be recovered.

      • Mhedz says:

        Oh, no. Well, yes! my friend told me the files was hidden by the virus. I tried to scan it and it works. But it only contains a folder “FOUND.000″ I open it and found all the files. But it cannot be opened. The file name was changed to FILE.0000CHK

      • sirmart says:

        That mean the folder already corrupted and cant be recovered. In fact u can delete the FILE.0000CHK.

  14. chibyc says:

    This is helpful. Weldone

  15. chibyc says:

    This is helpful. Weldone…

  16. ide says:

    this is soooo helpful. thank you so much!

  17. Eliza says:

    Thanks,this really rocks….

  18. azie1302 says:

    hello i would like to know how to recover the deleted infected application file in the pendrive??and the virus cannot be remove completely..

    • sirmart says:

      If u already deleted the file, u need to search for file recovery software. Most of it are shareware(paid). To completely remove the viruses, u need anti-virus like norton, mcafee, kaspersky,etc. It cannot be done manually.

  19. assalamualaikum broo. external sy dh infected virus then dh try step di atas tapi last sekali dkat run tu die kluar access denied. tolong broo data dlam tu sangatlah penting

  20. rev. himanshu says:

    hi mart thank you for the steps to recover data from pen drive.i recovered all my documents infected by virus and made it in shortcut.

  21. Tajun says:

    Terima kasih. Ilmu yg sangat berguna… Teruskan perkongsian ilmu…

  22. Affn says:

    https://docs.google.com/file/d/0B5pOwzXlaZQASHkwM1ZBRFJoQW8/edit?usp=sharing

    Assalamualaikum.
    My thumb drive being affected with virus a few weeks ago, i believe the virus is from a printing shop. I’m having difficulties accessing it after that as the antivirus blocking it. But after scanning with anti virus and it detect one virus and i decided to delete it as i never know anything about that file. So i proceed with deleting it instead of quarantining it. After that i can’t access my thumb drive anymore. And it prompted that problem starting _WVFAYJPX.init i believe that is the file i deleted previously but i’m not so sure *can refer to the image link above*. So my question is, would your technique above help me to gain back access to my thumb drive. Much help appreciated.
    :)

    • sirmart says:

      w’salam…

      According to the attached images, i believe that ur thumb drive still affected by virus. The shortcut to ur thumb drive is a sign/foot print of virus. Im sorry that i couldn’t guarantee the steps i write could grant you an acces to ur thumb drive again. Well, i suggest u to clean the viruses 1st through other PC with licensed & powerful anti-virus such Norton, McAfee, KasperSky, etc before proceed with the recovery steps.

  23. Mahafuz says:

    Dear Sirmart, Assalamualaikum. I am Mahafuz from Bangladesh. I want to know about how to recover hidden files from my internal hard disk. Few days ago my PC was infected by virus. I reinstalled my operating system Windows XP. Then I installed Avast! Internet Security 8 and scanned by this antivirus software the whole PC. After scanning the antivirus software deleted some of my files. Specially the video files. But when I follwed thefollowing steps asI am typing here “My Computer → Tools → Folder Options… → View → Enabled “Show hidden files andfolders” → Unchecked “Hide protected operating system files” → Apply → OK”, I can see those files are existing. Then I did thefollowing steps as I am typing here “Right clicked on one of those viewed hidden files → Properties”. But here I can see in “General” tab “Hidden” option is permanently enabled or tick marked. I can not pick the tick mark beside “Hidden” option off. Now what can I do? My files are existing but I can not recover those hidden files from my “Internal hard disk”. Can you please do something? Can you give me an appropriate solution?

    • sirmart says:

      W’salam.. It seem that the viruses have mark ur file as system file. That is the reason u can’t modified the properties of the file. I suggest u go to windows safe mode, run the cmd prompt as administrator, and apply the steps in my blog. Hopefully it can help.

  24. Mahafuz says:

    Dear brother you are right. Those files are now looks like system file. But what do you mean by “apply the steps in my blog”? How can I reach to those steps you are suggesting to follow? Please kindly do something!

    • sirmart says:

      U need to find the drive letter for the hardisk. Then go to command prompt by following the 3rd steps in the above guide. (Please read the post from the most top.)

  25. abdulla says:

    Assalamu alaikum …. When i connect my wd passport external harddisk … Shortcut folders were created for my folders and the folders were seem to be like hidden …. And hidden properties itself to be hidden …. I tried to recover but i couldn’t … What can l do???

    • sirmart says:

      W’salam.. For your information, not every hidden folders are du to viruses. Some hidden folder are protected system file used for encryption. In your cases, i believed that folder is a system folder for your wd external hardisk.

  26. Mahafuz says:

    Dear brother Sirmart, Assalamualaikum. Sorry for delayed response. Yes, brother it worked for me!!! I started my windows in safe mode by pressing F8 key. Then running the cmd (command) prompt I followed the steps as you mentioned in the upper most part of your blog for each of the drive of my “internal hard disk “individually. And I saw the magic!!! I found all of my hidden files for each of the drive of my “internal hard disk” in right folders exactly as they were in. To avoid typing mistake of that command I copied that command from your blog into a notepad. Because I was confused about the “space” between two characters of that command. If I am not wrong then there are “five” space in your command. Many many thanks from my heart for you brother. I didn’t know about your blog. Falling in that problem I searched a solution in Google and there I found a link of your blog. This is a nice fruitful visit of me in your blog. I am grateful to you. I think you are doing a nice job about IT related problems. May Allah do good for you both in this earth and in Akherat after death. Allah Hafez.

  27. Faizi says:

    thanks brawhh ;)

    • Dear Sirmart,

      Truly impossibilities became possibilities! That’s great! I am proud of you because you are a genius. I almost gave up to a point of becoming devastated, but I am now made whole again because of your unspeakable magic.

      I followed your instructions and things work out miraculously well. You are reliable and worth trusting.

      Please continue helping the world or else many innocent people will become unproductive as they continue to lose their data.

      Regards,

      Golden

  28. SCAR V says:

    THANK YOU!

  29. shabir dar says:

    thank u so much sir,
    I was so upset about the files which were hidden. By using ur command i retrieved the whole data.
    I m really thnkful to u. God bless u

  30. shehzad says:

    thank u very much i got my deta n m happy

  31. Iskandar says:

    Salam Mr.Muhammad, i have encountered the same problem towards my drive, when i googled, it goes to your page and guess what? i can now see my files, you dont know how much im indebt to you as within my drive has a lot of important client’s files and such. I wish you all the best and thank you so much, thanks alot. Keep it up.

  32. Vivian Tan says:

    Thank you very much!!! It works. Thanks alot!!

  33. Shaiful says:

    Assalam,

    I follow the step but shows Access denied – F:\$RECYCLE.BIN\S-1XXXXXXXX (NUMBER)
    Can you help on this?

  34. Prudence says:

    Thank you sir! It works! I’ve gotten my movies and documents visible again!

  35. Muhammad Talha Altaf says:

    it isnt working.
    i have files on my USB…. the original files are not visible, in place of that there shortcut are being displayed…..
    kindly solve my prob….
    thanks

  36. lily says:

    hlo plz hlp me.. I acidently conected my nokia c7 into a virus infectd pc.. Nw wen i ejected .. My fone luks like formatted. But the memory space is very less which i believe s dat the files are hidden . Plzz help me to unhide., i have imprtnt files in that

    • sirmart says:

      Connect ur hp to the pc via usb cable. Then, identify the drive letter for the storage of the hp. Next, apply the procedure to unhide the files through pc by applying the techniques on the drive letter for the hp storage.

  37. CT says:

    Thank you Mr Sirmart,
    It works!!! Was nearly had a ‘heart attack’ due to the crashed external hard drive. Thanks again.

  38. Davina says:

    Hello Sir, can’t i retrieve from my external hard disk? Because my driver is I. So when i type I. it says there is no I.

  39. Davina says:

    Sir, It says access denied and recycle bin. Does this mean that the files have been deleted?

  40. Henry Chonerwa says:

    Thanks man.
    it does very well. Bravooooo!!!
    am henry from Kenya

  41. Billy M. says:

    sir Mart IT thank you so much for the tip on how to recover the hidden files, a big help. kudos.
    Sallahm.

  42. nands says:

    hey what if I’m not able to see the files even after I do the whole process?? pls help, urgent!!

  43. sanjibsinha says:

    dear sirmart , i installed glairy disk explorer from link below

    http://www.glarysoft.com/disk-explorer/

    explored my hdd through it found files visible in thumbs.ms
    which was showing a huge disk space throwgh win 7 explorer
    but that contents are all visible…

    i hv copied them from therr..

    but i would request u to provide me some solution to get the files from that fucking thumbs.ms

    pls help

    sanjibsinha

    • sirmart says:

      Try remove the virus from the files first by using any reliable/trusted anti-virus. Some virus might appear like normal compress files. However, there is a possibility that the files already corrupted by the virus.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s