• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Hidden Files?

Y

yowen

Gawd
Joined
May 20, 2011
Messages
664
Hey guys, maybe you know what might be wrong here. I have a 40GB harddrive that my cousin gave me, something happened to it when he let a friend use his computer to browse the internet, the computer will not boot up anymore. So I connected it to my usb adapter to see what I could salvage.

Now if I right click on the disk to see how much space is used it says the hard drive is almost full.

But his pictures, music, videos are nowhere to be found on the harddrive. Even when I search for *.mp3 or *.jpg. So is everything hopelessly gone, or could it be hiding somewhere? This thing is/was running windows XP.
 
chances are the system was infected with a piece of 'ransomware' a trojan or worm that infects the system and hides everything then charges a fee for "recovery software" or something of the like. The data are likely to still be there, make sure you have "show hidden files" checked in folder options on your machine then inspect the content of the drive. Be careful not to infect your own machine in the process

On Win7:
Control Panel -> Folder Options -> 'View' tab -> click radio button for "Show hidden files, folders, and drives"
you may also want to temporarily un-check "hide protected system files"

If you find the files you should be able to do a batch removal of all the "hidden" flags.
 
Another possibility - I've seen something like this on several old computers running XP; the system crashes (software fault, hardware problem, power failure, whatever) and corrupts the file system. FAT says most of the drive is in use, but directories are messed up or missing completely. I'd suggest booting your favorite Linux recovery disk, then use dd to copy the corrupted drive to another drive (e.g. a USB-connected external drive). Disconnect the original, then try recovery software on the copy. "chkdsk /f" from a DOS or Windows boot disk might be enough; if not, there are plenty of other options out there. Copy the disk again, and try the next program, rinse and repeat. Worst case, you can send it to a data recovery specialist if you're willing to pay a lot of money for the files.

You *could* skip making a working copy, and try to recover the original directly, but that's asking for more trouble - you could easily make things worse. DDT unless you've no choice.
 
Nice catch Rowens, i had not even considered the drive being formatted as FAT (which would make sense given the size).
 
hmm, lets hope it's the hidden files problem.

Otherwise Not sure I have an unused harddrive somewhere.

Could it also be that it is simply miss reporting how full the drive is? But the files are actually gone?

How likely is it I'll infect a good computer with something bad that might be on this?
 
yowen said:
hmm, lets hope it's the hidden files problem.

Otherwise Not sure I have an unused harddrive somewhere.

Could it also be that it is simply miss reporting how full the drive is? But the files are actually gone?

How likely is it I'll infect a good computer with something bad that might be on this?
Click to expand...

Last first: if the drive is infected with something in the bootcode, booting from it could be a problem. If a file is infected, accessing the file could cause problems. Certainly something to watch out for, but then you should always be careful with any files you don't know the history of.

One other thing - is there a second partition on the drive? If memory serves, XP would only format 32GB if you used FAT32. So maybe there's a D: or E: out there too. If there's only a single 40GB partition, it's probably NTFS (which is good - NTFS is more robust, easier to fix), or it was formatted with a custom program that didn't have the 32GB limit.

As far as how "full" the disk is, that depends on which number you look at. The File Allocation Table basically maps the "in use" chunks of the disk. When you write a file to disk, the data is dumped into free clusters, and then those clusters are marked as in use in the FAT, and chained together so that you can get the data back out sequentially regardless of where on the disk it is stored. After that's done, the relevant directory (which is actually just another type of file) is updated with a filename, size, datestamp, etc., and a pointer to the first cluster used by the file data. Normally the "in use" count for the FAT should match the total number of bytes used by all files, once you round up to the next cluster boundary for each file.

Of course when the FAT and the directory structures get out of sync, Bad Things happen. A missing directory entry means you have a "lost chain" of clusters - the data is there, and probably intact, but there's no named pointer to the start of the chain. The good news is A) corrupted directories are more common than corrupted FATs, and B) as long as the chain is there, chkdsk /f will probably let you convert it back to a file or directory. Names will be gone, but you can probably figure that out by looking at the raw data in each file.

If the FAT is corrupted, all you've got are raw sectors on the disk, order unknown. You can't even tell for sure if you're looking at real data, or just the remnants of old junk, because normal deletion just marks clusters as available for re-use, it doesn't overwrite them. At that point... well, do you like hexadecimal jigsaw puzzles? (FWLIW, I actually had to do this many, many years ago on a floppy that had the only copy of a lab report that was a big part of a course grade for our lab group. Even knowing exactly what to look for, and working on a floppy holding only a few hundred kb, rebuilding the VTOC *sucked*. If the FAT is corrupted, do NOT try this unless you're really, really patient and want those files bad enough that you're willing to trade a lot of time and part of your sanity for them.)

As far as not having a scratch drive to work on: another option, if you've got 40GB free on an existing drive, is to use dd to copy the bad drive to a file, then try to recover data. If data recovery hoses the original drive, you can theoretically copy the raw data back to the original drive, then try again. I don't like doing this because it is riskier than using a spare drive, but it's better than nothing. The other option is to just ignore the seatbelts and floor it - go ahead and try chkdsk/fsck_msdosfs/whatever on the original disk and hope for the best.
 
If memory serves, XP would only format 32GB if you used FAT32.
Click to expand...

Drives could come factory formatted to larger than 32GB or you could use an external tool to do that. The restriction was only in the format program itself not in the OS.

Last first: if the drive is infected with something in the bootcode, booting from it could be a problem.
Click to expand...

Booting from a linux livecd like a recent ubuntu release with the drive installed will totally avoid this. Although putting the drive in some other machine as a non boot drive should be fine as well.
 
Last edited:
You must log in or register to reply here.
Back
Top