Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

There were some viruses on my laptop which got into my 500GB drive. All viruses cleaned but now the files are not visible. When I check the hard drive size it hasn't gone down but is the same as before.

Does this mean my files are still there? If so, how can they be retrieved.

share|improve this question

closed as unclear what you're asking by Excellll, mpy, Michael Kjörling, gronostaj, Tanner Aug 26 '13 at 15:01

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

    
did you at least try "Control Panel\Appearance and Personalization\Show Hidden Files & Folders"? –  Logman Aug 18 '13 at 23:10
    
What does "files are not visible" mean? Where are you looking and what exactly are you seeing? –  David Schwartz Aug 18 '13 at 23:10

3 Answers 3

up vote 0 down vote accepted

If the files are Hidden, try to do something like this

If they have been deleted, try Recuva, however if that happened you should see freed space.

EDIT: according to the comment, the problem might lie elsewhere, maybe the virus messed around with the files and placed them somewhere else. Use WinDirStat or some other disk usage statistics viewer to enquire about where most space has gone to.

EDIT + UPDATE:

To restore hidden folders to their original state you should do the following. Note that I'm on a Portuguese version of Windows XP, but the core is there, it should be transversal to Windows 7 or 8, and I'll make it as easy to understand as possible:

Assuming that you have a mix of non-hidden and hidden folders like the following...

Mix of regular and hidden folders

...select them all, then press the right button on any folder, then go to Properties. You can do the same from the menu bar but this way it's easier.

Accessing Properties

A window like the following will appear. Uncheck the Hidden (in my version labeled Oculto) checkbox, then press Apply.

File property window

If you are doing this from a NTFS Partition (most likely, unless these files are on an external drive) another window will appear asking if you want to make this change to ALL files, even those included inside the folders and those inside the folders inside the folders and so on. The main disadvantage in doing that is that some system files (namely desktop.ini and thumbs.db will from now on appear even if you have the "Show hidden files option" disabled). If this bothers you, check inside the hidden folders if the files inside them are also hidden. If they are, it is less bothersome to allow this, unless you want to do this over and over again.

Subdirectory action spread

Lastly, the end result is something like this. All files have become unhidden.

All files are unhidden

share|improve this answer
    
I did do the "show hidden files" thing before but there's no difference. The files seem "hidden" but in some other manner probably. The hard drive space has not free up so I suspect that the files are there. Any new files you put there, they are visible and usable. But ones before are not. You cannot see any folders even. –  cyclicprefix Aug 19 '13 at 0:39
    
I used windirstat and could see all the folders/files. So I checked the folder options again and this time unticked the 3 'hide...' options. Here's a screenshot. img94.imageshack.us/img94/6428/77v1.png And then the folders got visible like this: img198.imageshack.us/img198/7269/kfii.png Now, how do I restore them as normal folders? –  cyclicprefix Aug 20 '13 at 22:24
    
See updated post. –  Doktoro Reichard Aug 21 '13 at 3:35
    
The hidden option in properties is greyed out. It cannot be clicked. What do I do now? i42.tinypic.com/904to1.png –  cyclicprefix Aug 21 '13 at 7:22
    
I redirect you to this post that explains how to do this from the command line. I might write something later (as I'm currently busy), to place it here on SU. –  Doktoro Reichard Aug 21 '13 at 8:12

Your best bet is to use a Linux LiveCD and investigate the filesystem. This will avoid any permissions put in place by Windows and sidesteps any malware tricks.

  • Check directory and file sizes using du --si /path/to/folder
  • Find large files graphically using gdmap
  • Recover deleted files with photorec (part of the testdisk package)

Recommendations for the LiveCD include: Knoppix LiveCD, GParted LiveCD, Linux Mint LiveCD, etc.

share|improve this answer
    
Is there an equivalent windows only solution? I do not have access to linux. –  cyclicprefix Aug 19 '13 at 21:34

Your files may still be there.

When an operating system such as windows deletes a file, the file is not removed. Instead just the pointer to the file is removed. The operating system then considers the blocks where that file was located as free, and allows other programs to overwrite that data.

You can use a file recovery program to attempt to recover those files.


Steps to recover Data

  1. Stop using the computer immediately ! (That includes going online, or installing any file recovery programs). If the files are important do not try and recover them yourself. It can actually do more harm. Take the drive to a data recovery specialist.

  2. Take a snapshot of your current drive. Use a utility like ddrescue to create a clone of your hard drive. Always perform your first recovery attempts on the clone, not the actual drive.

  3. Use a data recovery tool to scan for possible file fragments. The best that I have found are

    • RIPLinux (Recovery is possible), Is a bootable linux distro with a lot of recovery tools.
    • Data Rescue 3 (Mac), I've never had it not recover files from a working drive
    • Active@ (Windows), Worked for me when every other program failed.
    • BartPE - A windows disk that has a lot of good diagnostic & recovery tools
  4. If a program recovers files, do not recover them directly to the drive where they were lost, it can actually overwrite itself. Save the files to a different drive.


15 free file recovery programs
inodes on linux
How to recover deleted files

share|improve this answer
    
Remember that the poster said the space was seemingly occupied, so the chances are that the files are still there; otherwise the harddrive would reflect that free space had become available. –  Doktoro Reichard Aug 18 '13 at 23:20
    
yes that's true. I don't think they are deleted just not accessible for some reason. when the virus first got in, the folders had changed their icons from the usual win 7 ones to application type icons. So the folder name would be xxxx.exe rather than just xxxx. now after the antivirus scan these are gone but the HD space remains the same. –  cyclicprefix Aug 19 '13 at 0:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.