Recovering data from a flash drive after a virus. Files are missing, what should I do? The files have become invisible or hidden. The program recovered files, but some do not open, what to do

A USB flash drive is not the most suitable device for permanent storage of files, but everything happens in life. And situations where valuable data that was only on it were accidentally erased happen regularly. However, in about half of the cases of grief, you can help - recover deleted files from a flash drive. Under what circumstances is this possible and how to do it, read on.

I won’t give hope in vain: the chances of successful data recovery from USB flash drives are lower than from stationary drives - hard drives of PCs and laptops and permanent memory of mobile devices. The reason is that flash drives are usually used to transfer files from one device to another. And accidentally deleted data most often turns out to be simply overwritten, sometimes even more than once. And overwriting, unfortunately, destroys information irretrievably.

Full or partial file recovery on your own is possible in the following cases:

The user deleted them manually.
The drive has been formatted using the operating system.
The files became inaccessible after a virus attack.
Files disappeared after splitting the flash drive into sections.
There was a logical failure of the file system: it became defined as RAW - unknown, or Windows and programs consider the entire space of the device to be unallocated.

The chances of recovery are extremely low or zero if:

The flash drive is physically defective - it is not detected by the computer at all or is recognized as an unknown device, access to its memory is either completely absent, or the size of the latter is several KB instead of tens of GB. The exception is relatively simple breakdowns that do not affect the controller and device memory.
The files were deleted using a shredder program.
The flash drive was low-level formatted (in fact, it was repartitioned and overwritten) or flashed (it was overwritten by the controller microcode).
The files are encrypted, but there is no decryption key. It may be the result of an attack by an encryption virus or user actions (encrypted, but lost the key). In the first case, it is sometimes possible to recover files if there is a suitable decryptor.

With physical and complex logical malfunctions, data recovery from flash drives is sometimes possible, but it often costs the owner very much - up to several tens of thousands of rubles (not even the result, but an attempt to restore can cost so much). Therefore, in such situations, many prefer to say goodbye to files forever.

How to increase the likelihood of success

Even if your case is classified as simple, in order to increase the chances of a successful recovery, adhere to the following rules:

The fewer operations were performed with the file system of the drive, the better the result. Therefore, start restoring as soon as you notice the loss of files.
Save the recovered data only to other physical media (computer hard drive, second flash drive, etc.).
Try to restore everything in one session. Do not interrupt it unless absolutely necessary.
If one recovery program does not help, use others. Sometimes simple free utilities are more effective than expensive paid ones. What will help in your case is impossible to know in advance, so try everything that is available.
If the recovery program is able to create and save images of drive file systems, be sure to use this feature. In the event of an unexpected flash drive failure or accidental overwriting before the end of reading, you can restore data from the image.

7 best flash drive data recovery software

Some of the mass storage data recovery programs you may already be familiar with. Our site talked about them in an article about. Today, our collection will be replenished with seven more applications of the same purpose. Maybe just one of them will be saving for you.

R.saver

Wise Data Recovery

Wise Data Recovery is another worthy tool for recovering information from fixed and portable drives. Released in Windows version only. Like its predecessors, it works without installation on a hard drive. It has a high scanning speed and displays the possibility of recovering each found object.

If next to the file is:

Red circle - the data is completely overwritten, it will not be possible to restore it.
Yellow circle - partial overwrite, success is not guaranteed.
Green circle - the file is not overwritten and is recoverable.

When clicking on "green" files, if it is a picture or a document, the program shows their thumbnails (if saved). It also has the function of searching for certain types of data by keywords: pictures (imagies), audio (audios), videos (videos), documents (documents), archives (compressed files) and mail (emails).

Wise Data Recovery is a completely free application and, by the way, with Russian language support.

How to use Wise Data Recovery:

Unzip the archive with the program to any folder and run the executable file WiseDataRecovery.exe.
Select the desired media from the list and click Scan.
Select the files you want to recover from the list. Click the "Recover" button.
Specify where to save files on your hard drive.

Disk Drill

The Disk Drill utility, well known to many Mac OS X users, appeared in the Windows version some time ago. More precisely, in two: free - free, and paid - pro. Free allows you to recover up to 1 GB of information, paid - without restrictions.

Unlike the previous three applications, Disk Drill requires mandatory installation on a computer (for which it gets a minus, since this simple operation can lead to overwriting the data that the user was just about to recover). But it has a number of benefits that others do not have.

With constant use, Disk Drill keeps a record of deleted files, and also creates backup copies of them, which increases the chances of recovering them even after a while. In addition, it supports any type of storage device and almost all file systems (it knows more than 300 unique file signatures).

Disk Drill does not have Russian localization, but it is quite easy to use.

How to recover deleted files with Disk Drill:

Install the application on a PC and run it with administrator rights.
Select the USB flash drive with the deleted data from the list of media.
Open the drop-down list next to the Recover button, which is located opposite the flash drive, and click the desired scan type: "Run all recovery methods" (use all search and recovery methods), "Quick scan" (quick scan), "Deep scan" (deep scan ) or "Load last scanning session" (load the result of the last scan). Click the "Recover" button (or "Continue" if you have already started working with the media).
In the next window that opens after scanning, select the necessary files from the list, specify the location for saving them and click "Recover" again.

RS File Recovery

RS File Recovery is a paid Russian-language application. In addition to the main one - recovering information from physical drives, it is able to save and subsequently work with their images. After creating the image, the physical device with data can be turned off, since the program has already “remembered” all its contents. In addition, the application has a built-in HEX editor for manual byte-by-byte correction of files, as well as an FTP client for uploading recovered files to network resources.

After analyzing the storage device, RS File Recovery displays information about the data on it - when it was created, when it was changed, whether it can be restored. This information is displayed in the bottom pane of the window.

Unfortunately, in the free demo version of the utility, the restore function does not work, only viewing is available. The cost of a license starts from 999 rubles.

Like Disk Drill, RS File Recovery requires installation on a computer.

How to use RS File Recovery:

Launch the application. Select a flash drive from the list of media by simply clicking on it. All its contents, including deleted files, will be displayed in the middle part of the window.
Click on the item you want to restore. Information about it, including the forecast, will be shown in the panel below.
Drag the necessary files to the recovery list on the right side of the window and click the "Restore" button.
Select the save method: hard disk, CD/DVD, Internet via FTP, or conversion to a virtual ISO image.

Specify the destination folder on the hard drive. If you choose other save methods, follow the instructions of the assistant.

Ontrack EasyRecovery

Ontrack EasyRecovery is one of the most functional and efficient data recovery programs, the main competitor of the industry leader R-Studio. It successfully extracts data even from badly damaged media, supports all types of file systems and more than 250 file formats, creates virtual images of physical storage devices, can boot from DVD and USB flash drives, and also has a lot of other usefulness.

EasyRecovery is available in several paid editions with different feature sets. The most inexpensive - home, will cost the user $ 79 per year. Professional, enterprise and specialized (for servers) cost from $299 to $3000 for an annual license.

Despite the grandeur of the possibilities, even a novice user can use this program, since each stage of work is accompanied by a built-in assistant. It is also impossible to make a mistake because it is fully translated into Russian.

How to use Ontrack EasyRecovery:

Run the application (it is available in installation, portable and, as already mentioned, bootable versions). Specify the media type on which the deleted data resides.
Select the volume to scan (if it is a flash drive, then it usually has only one volume).
Select a recovery scenario. Restore objects after deletion and formatting - different scenarios. First, try the first one - it works faster, and if it doesn't help, the second one.
If the data is affected by a logical failure, specify one or more types of file systems that may be on the media.

Check again that the conditions are correct and confirm your selection. After that, the program will start scanning the flash drive.
After scanning is complete, select the desired objects in the list (to select several, press and hold the Ctrl key). Click the "Save" button in the top bar of the main window and specify the destination folder on your hard drive.

To create an image of a storage device and work with it in the future, after starting the program, select the device in the list of media, open the "File" menu and click "Create Image File".

Active UNDELETE

Active UNDELETE is another paid utility that successfully copes with the recovery of individual deleted objects and entire disk partitions. Supports all types of media, all file systems and over 200 different file formats. In addition to the basic task, it allows you to solve related tasks - fix partition table and boot records errors, create, format and delete disk volumes, etc. Like most paid counterparts, Active UNDELETE supports creating virtual drive images.

The demo version of the program, available for free download, has a full range of functions, but does not allow you to recover files larger than 1 Mb.

The Active UNDELETE interface is exclusively in English, but the utility is easy to use, as each action is accompanied by a wizard.

Unfortunately, it does not have a portable version. Installer only.

How to work with Active UNDELETE:

Run the program. Click in the first window that opens "Recover deleted files" (restore deleted files). This will launch the recovery wizard.
The first window of the wizard is a brief summary of the program in English. Click "Next" to move to the next step.
Next, select one or more devices that contain the files you need. Click "Next" and in the next window - "Scan".
After scanning, mark the items you want to restore and proceed to the next step.
Set save options - folder, filenames, rename in case of matches, etc. You can leave everything by default.

The last step is the restoration itself. To launch it, click the "Recover files and folders" button.

If you want to create a virtual image of a flash drive, open the "Disk image management" section in the main window and run the "Create disk image" wizard.

All files and folders on it become hidden by viruses. Because of this, users are facing a problem. There are files on the flash drive, but I can't open them. In this article, we will consider just such a problem. Now you will learn how to open hidden files on a flash drive.

Step #1: Find a computer with an antivirus.

If the files on the flash drive have become hidden, then the flash drive has been infected with a virus. It is possible that not even one. Therefore, you can’t just connect this USB flash drive to the first computer that comes across. Otherwise, you will put your computer at risk and in some cases the computer may be infected with viruses that are on the flash drive. Therefore, first of all, you need to find a computer with an antivirus. Also, before connecting an infected flash drive, you need to make sure that the antivirus is up and running.

Step number 2. Connect the flash drive to the computer and check it for viruses.

After you have found a computer with an antivirus, you can connect a USB flash drive to it. Immediately after connecting, open "My Computer" and right-click on the icon of the connected flash drive. In the menu that opens, select "" or "Scan for viruses" if you have an English version of the antivirus. After that, wait until your antivirus checks all the files on the flash drive.

Step #3. Turn on the display of hidden folders.

In order to open hidden files on a flash drive, we need . To do this, you need to open a window with settings called "Folder Options".

If you are using Windows 8 or Windows 10, then you need to open any folder and on the "View" tab, click on the "Options" button.

If you are using Windows 7, then you need to open any folder and press the ALT key. After that, a series of drop-down menus (File, Edit, View, Tools and Help) will appear at the top of the window. Here you need to open the "Tools" menu and select "Folder Options".

This will open the Folder Options window. In this window, you need to go to the "View" tab and scroll to the end of the "Advanced Options" list. There you need to uncheck the box next to the "Hide protected operating system files" function and check the box next to the "Show hidden files, folders and drives" function. After that, you need to save the changes by clicking on the "Ok" button.

After these simple manipulations, hidden files on your flash drive will become visible, and you can open them.

Step #4. Make hidden files and folders on the flash drive visible.

You can also make hidden files and folders visible again. To do this, select hidden files or folders on the flash drive and open their properties. After that, uncheck the box next to the "Hidden" attribute and save the changes by clicking on the "Ok" button.

It should be noted that sometimes after infection with viruses, the “Hidden” attribute is not removed. In such cases, the easiest way is to copy the files to your computer and delete such a folder.

Additionally. You can also open hidden folders on a flash drive using . To do this, open a command prompt and go to your flash drive. To do this, simply enter the drive letter followed by a colon. It's done like this:

After that, enter the following command:

attrib -s -h *.* /s /d

On the command line, it would look something like this:

The execution time of the attrib command depends on the number of hidden files and folders on the flash drive. It usually only takes a couple of seconds. After the command line prompts you to enter the following command, you can check the flash drive. If everything was done correctly, then all hidden folders and files on the flash drive should become visible.

After using their favorite flash drive on an unfamiliar computer, many users are horrified to find that all the materials stored on it somehow disappear in a strange way, turning into shortcuts, although the amount of occupied space does not change. In principle, there is nothing to be surprised here. The reason for this is a virus on a flash drive in the form of Trojan.Radmin.13 or autorun , which simply transferred all the data to a folder invisible to Windows. Is it possible to get rid of it? Of course! And to do this is as simple as restoring all the information that has disappeared on a flash drive after this virus.

Step #1: Setting up data display in Windows

Before recovering data on an external drive after a virus attack, you may need to set new options for displaying hidden folders and files on your computer. In this case, first you need to go to the "Start" menu, open the "Control Panel" section and select "Folder Options" in it. After that, in the window that appears, click the "View" tab, find the options for hidden directories and files in the context menu and check the box next to the "Show ..." item. Next, uncheck the box next to the line "Hide protected ..." and click the "Apply" button with the mouse:

Having completed the inclusion of the display of hidden folders and files, you can safely move on.

Step #2: Removing Viruses from Your External Drive

After Windows is configured to work, you need to work on how to remove the virus from the flash drive. In this case, you can cure an external drive from autorun using any antivirus installed on your computer. It could be:

Avira;
Norton Antivirus;
NOD32;
Kaspersky Anti-Virus;
Dr. Web;
Avast;
Panda Antivirus, etc.

The signature databases of these programs are practically the same today, so each of them can be trusted to recognize and remove trojans, autorun and other viruses on a flash drive. At the same time, the procedure for working with these antiviruses is standard. All that is required is to install an antivirus program on the PC, configure it to automatically scan external drives, and after connecting the flash drive, wait for all viruses to be removed from it.

You can also cure a USB drive using special utilities. For example, programs with a built-in antivirus such as AVZ, Virus Removal Tool from Kaspersky Lab or Dr.Web CureIt can help remove viruses from a flash drive:

At the same time, high-quality protection of the flash drive from autorun will be provided by Antiautorun, FlashControl, Vigilant Eye,. The latest antivirus, in particular, is unpacked on a USB drive, which allows you to use it to ensure security when connected to other computers:

You can also scan and cure an external drive for viruses via the Internet. In this case, online antiviruses such as Online Scanner from ESET, Security Scan from Kaspersky, Panda ActiveScan will help you search for autorun and other viruses on the flash drive.

However, if access to the Internet is limited, you can try to clean the external drive manually. To do this, you will have to find and remove all shortcuts with permission (.lnk), unknown files in the format (.exe), autorun.inf and RECYCLER from the flash drive:

Step #3: Restoring Materials on an External Drive

Having treated the flash drive with an antivirus or manually cleaning it from autorun, you can safely proceed to recover the data hidden on it. In this case, instead of shortcuts, you can get full-fledged folders with "lost" information in several ways.

Option #1: Debugging via command line.

In order to restore data on an external drive, go to the Start menu, type cmd into the search bar and press Enter. After that, in the command line that opens, enter the value cd / d A: \ (A is the designation of the letter of our flash drive), press Enter and execute either the dir / x / ad command, and then ren E2E2~1 NEWF , or just the attrib -s command - h/d/s:

In either case, doing so will invalidate the attributes for the hidden folders, eventually converting the labels into valid data directories.

Option #2: Setting up via Total Commander

One of the reasons to install on your computer is the ability to use this file editor to get "lost" directories with files instead of empty shortcuts. So, in order to restore data on a flash drive, we press the "Hidden Items" button in the program, and then open the drive that needs to be brought back to normal. Next, we find the folder with a red exclamation mark, right-click on it and select the "Properties" option in the context menu that appears:

Now in the "Attributes" section, uncheck the "Hidden" item, click "Apply" and confirm the application of the action for all internal files and folders:

As a result, instead of empty labels on the flash drive, we get the catalogs we lost. At the same time, it is easy to see that based on these functions, Total Commander can also be used to search for hidden viruses, for example, RECYCLER or autorun, thus replacing the antivirus.

Option number 3: Recovery with special utilities

To restore data on a flash drive, instead of Total Commander, you can install one of the recovery utilities on your laptop, for example, USB Hidden Recovery / Folder Fix,. So, in the first two programs, it’s enough to select a flash drive that needs “resuscitation”, and then start the recovery by pressing the appropriate key:

It is practically also easy to fix the detection of hidden materials on the drive and through the utility. The process of performing this task with its help will look like this:

Option #4: Using a Healing File

After checking the flash drive with an antivirus and removing autorun and other viruses, you can use the curing bat file to restore hidden documents, which contains a set of codes for setting the display settings for hidden directories:

You can either download it or create it manually by saving the specified list of commands in a text document, and then changing its format from (.txt) to (.bat). One way or another, in order for the method to work, you need to move the bat file to a USB flash drive.

Hi all! The other day I faced a real viral epidemic. They brought 3 flash drives on which all the files disappeared, and the folders were empty. This article is about how to solve this problem.

Files on a flash drive can disappear for two reasons:

Accidental deletion
In this case, you can try to restore files from the trash (provided that they have not been permanently deleted). Or use a special one.
Virus
A virus is the most common reason for missing files from a flash drive. The whole difficulty lies in the fact that no antivirus will return the missing files, and you will have to restore the files manually.

How to recover files on a flash drive after a virus

If the files disappeared from the flash drive after being used on your computer, then you will have to get rid of the virus first, because the files from the flash drive may disappear again. Most likely you already have an antivirus installed, then most likely it will not help, because. already missed the virus in your computer. But you can run a full virus scan for prevention.

Many well-known antivirus vendors release free virus scan and removal utilities, such as DrWeb Cureit, Kaspersky Virus Removal Tool etc.

First, let's download and run one of them. I will describe the process with an example.

After downloading, run the downloaded file and after downloading and initializing, click "Start Check"

Depending on the speed of the computer, the check can take 5-15 minutes.

If threats were found, the utility will prompt you to remove them. To do this, select the actions and click the "Continue" button. You may need to restart your computer.
After that, you can start restoring files.

The most common type of virus is one that makes files on a flash drive hidden. To check if this is the case, go to the control panel in the "Folder Options" section and check the box "Show hidden files and folders"

After that, you will be able to see the files on the flash drive.

They all have the “hidden” and system attributes, and changing these attributes just won’t work.

To make hidden files on a flash drive permanently visible, run a couple of commands from the command line.

To do this, press the key combination Win + R, enter cmd, click OK. Or go to the menu "Start" - "Programs" - "Command Prompt".

In the cmd.exe window that opens, enter:

cd /d f:\ and press Enter

attrib -s -h /d /s and press Enter

f:\ - this is the letter of the flash drive, you can see it in "My Computer", respectively, if your flash drive has the letter E: then you need to writecd /de:\

This command will go through all the files on your flash drive and change the attributes back to normal. You can go to the flash drive to see that the files have been recovered.

Program for recovering files from a flash drive

If you accidentally deleted a file from a flash drive and did not find it in the trash, or a virus tried, then a program to recover deleted files from a flash drive will help. I will describe the process of recovering files using the program. For example, I deleted the file from the flash drive "Report.ods"

To increase the chances of recovery - do not use a flash drive, do not create new files.

Launch the program and choose which files you need to recover.

To increase the chances of recovery, create a flash drive image on your hard drive.

Select a location on the virtual disk (the same flash drive image)

After recovery, the program will display a list of files available for recovery. There we see our Report.ods file

Select the file, click restore and choose the path where to drop the restored file.

As you can see, the file has been restored.

In the same way, you can recover not only deleted files from a flash drive, but also from any media, even from a hard drive.

In the wake of the forum topic, folders disappeared from the flash drive. This note summarizes the recommendations found in it. Description of the situation: Folders no longer appear on a storage medium, as if they had been deleted. However, the amount of space occupied by them remains unchanged, i.e. the space is still occupied by the disappeared folders and files in them. Most likely, this indicates that the information was not deleted, but simply the folders became invisible. This happens as a result of the actions of some viruses. Here are ways to make folders visible again:

Enable showing hidden files and folders in File Explorer

The simplest case is when the "hidden" and "system" attributes are set for folders, and Windows is configured in such a way as not to show hidden files and folders. It is enough to turn on the display of such data and remove the attributes as described in the article: display of hidden files and folders.

Remove attributes using the command line

Another way to make data visible is through the command line.

1) Open a command prompt: Start -> Run -> type: cmd -> click "OK";

2) In the black command line window, type:

(where X is the letter of the drive or flash drive)

3) Select and copy the line below:

Attrib-s-h-r-a/s/d *.*

4) Right-click on the black command prompt box and press the Enter key.

Wait while the utility replaces the attributes of all files. After that, the files and folders will become visible.

File Manager Total Commander

First you need to enable the display of hidden. To do this, go to the "Configuration" menu, then "Panel Contents", check the box for "Show hidden system files".

Open the flash drive, select the directories with an exclamation point and remove the attributes: go to the "File" menu, then "Change attributes". We remove the attributes and click "OK".

Far Manager file manager

You can also use the Far Manager file manager, which by default shows any hidden and system folders, and also allows you to remove unnecessary attributes. Download it, install it and run it. Further:

1) Open the flash drive in Far Manager: press the combination "Alt-F1 ; (left panel) or "Alt-F2 ; (right panel), then select the letter of the required media from the list.

2) Using the "Insert" key, select the hidden folders, press "Ctrl-A", remove all unnecessary checkmarks from the "Read only" and "System" items, leave only "Archive", and confirm with the "Set" button.

Here you can clean the RECYCLER folder, delete shortcuts (.lnk), unnecessary executable files (.exe), and be sure to delete the autorun file. inf, if present.

After these steps, the data on the flash drive will be displayed in its normal form.

Some viruses go further - they rename or move folders to the E2E2-1 directory, which is not displayed in Windows Explorer. This is relevant only if the media file system is FAT32; this problem does not exist in NTFS. To find out what file system is on the flash drive, open "My Computer", right-click on the flash drive, select "Properties" from the drop-down menu. In the window that opens, look at the line "File system".

For example, if your flash drive is connected as the "E" drive, then go to:

Start -> Run -> cmd -> OK

In the black window that opens, you must enter the commands one by one, confirming each with the Enter key:

The first command makes drive E active. If the media letter is different, replace the E before the colon with your letter.

The second command displays a list of folders and files on the media. If E2E2~1 is listed, run the command to rename the folder:

3) ren E2E2~1 NewFolder

After that, the NewFolder folder will appear in Explorer. Instead of NewFolder, you can specify any other folder name, if you wish.

In conclusion

That seems to be all about the restoration of lost information after a virus. Just do not forget that before the listed actions, it is necessary that the virus itself be neutralized by the antivirus, otherwise the problem will recur.