0

Context of the problem: The other day I had my USB borrowed and got it's contents modified by some type of minor malware I'm guessing. I could no longer find my files but they were taking up space.

Problem: I cannot access my files that are in my USB drive I cannot see the directory or access it, my drive contains the files but I cannot cd into the folder from the terminal since it's name similar to .

Steps I took trying to access or recover the files: I first proceeded to try and view the files on a Windows machine on the regular Explorer with hidden files being revealed, after that step proved not to work at all I proceeded to list the files on my CMD prompt using the following command: dir /s/a \\?/d:/ESD-USB and got back a dump of the files and directories that are currently in my drive, part of the dump looks like this:

Directory of \\?\d:\ESD-USB\ \boot

10/29/2018  02:06 PM    <DIR>          .
10/29/2018  02:06 PM    <DIR>          ..
09/29/2017  09:08 AM            16,384 bcd
09/29/2017  03:59 AM         3,170,304 boot.sdi
09/29/2017  03:59 AM             1,024 bootfix.bin
09/29/2017  09:08 AM           106,528 bootsect.exe
09/29/2017  03:59 AM             4,096 etfsboot.com
09/29/2017  09:08 AM           818,072 memtest.exe
12/27/2017  06:01 AM    <DIR>          en-us
12/27/2017  06:01 AM    <DIR>          fonts
12/27/2017  06:01 AM    <DIR>          resources
6 File(s)      4,116,408 bytes

I also tried accessing the files from my OSX machine and could not list them using ls -la. The only way I could see my files in my drive was with the previous step.

What I need or would like to know: I would like to know how to access my files in the first place so I can move or copy them to somewhere accessible on Windows or OSX using the terminal on either platforms.

Note: /boot is only one of several folders that are within the USB drive (example: / /boot, / /files, / /IT, are directories where my files live and I can't access normally).

Improve this question
10
  • That looks like a Windows installation media. Most likely your files are gone. If the person who borrowed you stick used it to create Windows installation media that's certainly the case. And those aren't "messages", it's a list of directories/files typical of the media I just commented about. In summary, you no longer have the files that once were in that stick.
    – user931000
    Commented Nov 12, 2018 at 5:37
  • @GabrielaGarcia I only posted an example of one of the directories in my USB, since it's a boot USB and I sometimes use it for moving small files I didn't want to bother posting all the subdirectories so I only posted the boot part so I was a bit clear with an example. I have more folders apart of /boot, for example, /files and /IT folders.
    – Armando Herra
    Commented Nov 12, 2018 at 6:10
  • 1
    Why post an "example" that's totally unrelated to the question? By the way, what is your question? Is it how to recover files that apparently were deleted? If so any of the usual tools may help (or not) but software recommendations are off-topic here. Now the part about "script" and "empty name directory" seems totally nonsensical.
    – user931000
    Commented Nov 12, 2018 at 6:19
  • @GabrielaGarcia I'm sorry if I was not clear enough, my question is how to move or access these files by terminal. I thought that was clear already. And my example is not unrelated, it's part of a dump I obtained when listing the files in the drive. My question then is again, how to access and or move these files so I can recover them using the terminal, never did I ask for software recommendations.
    – Armando Herra
    Commented Nov 12, 2018 at 6:23
  • @GabrielaGarcia I've edited several parts of my question hoping it's a bit more clear for you and any other person willing to read and maybe help with this matter. Thanks.
    – Armando Herra
    Commented Nov 12, 2018 at 6:29

1 Answer 1

Reset to default
0 
\\?\d:\ESD-USB\ \boot

Just means an unprintable character. Check disk than boot any livecd with Linux you could recover all files. Additionaly you may try dir d: /s /a:h to view if there set hidden attr to files. If so you should check your disk with anti-malware

Improve this answer
1
  • Thanks, will do and I'll come back and post my results.
    – Armando Herra
    Commented Nov 12, 2018 at 6:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .