Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

After recovering my system from a malware attack, I restored all of my previous settings, run malware/virus scans, etc. Everything appears to be back to normal, except:

E:\ directory tree does not display contents, though data is present when the disk properties are examined. I was able to recover most of the data in the tree using recuva, though not all of it.

If I run a microsoft security essentials scan on the E: drive all of the old files and data and it's file tree are visible and scannable. And when I try to copy the recovered data back to it's original location, windows tells me that all the data already exists in that location and asks if I would like to replace it.

This is very confusing because it seems that windows is aware of and able to view all of the data on the hard drive, but it does not show the presence of any files in the explorer.

Is there anything that can be done to restore the file tree?

share|improve this question
The driver letter alone does not give us enough information. What is supposed to be mounted there? Does it happen even when you mount a different volume to E:\ ? – iglvzx Dec 29 '11 at 4:25
Drive letter is ancillary - it is a 1TB hard drive which stored 60 GB of data. I use another hard drive for my main partition (C:). I updated the title to reflect these corrections. – Dylan Dec 29 '11 at 4:29
It is possible the malware set all the file attributes to hidden. If you show hidden and 'protected operating system', can you see anything? – iglvzx Dec 29 '11 at 4:41
Yes, that was the problem. Thanks. – Dylan Dec 29 '11 at 5:00
Out of curiosity, what was the malware name/identifier and vector of infection? – horatio Dec 30 '11 at 20:58

To add on to Matt's answer, you can run the following in the command line to restore file attributes:

attrib –s –h *.* /S /D
share|improve this answer

The malware set the file attributes on the drive to hidden and protected/system. The solution should be as simple as setting Windows Explorer to show hidden and protected files.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.