[jazzy007]

My PC got a virus where it obscure my data on my hard drive partition. In short worlds, a program download by my wife as a Windows fixer took over my PC. Got the virus out but not before it did some harm to my PC. Many of Windows file were delete. In short, I had to reinstall Windows. No problem. Got it running, but the data on my partition was gone. I look into my D: and E: drive and it show empty or nothing. But the defrag show there is data there and so does the antivirus. The question is how to retrive that data. Most are pictures and school papers.

jazzy2945@att.net

[LiveBrianD]

I think it hid your files, but didn't actually delete them. Go into folder options, and set it to show hidden files. Now do they show up? If not, go back to folder options and also set it to show system files, then look again.

[Dellinsp531]

You can use a live linux cd (or USB) (ie puppy or DSL (Damn Small Linux) to boot up the computer and see if they can see any data on the partition drive. THe reason for this is that windows write data to drive and might override the date. Live Linux will boot into RAM and not write any data to drive and overwrite any delete data.

If that data is there, than it is just hidden. So you can just unhide it.

If the data is not there, than you can use a recovery program from Ultimatebootcd to try to recover any deleted files off the partitions.

[SpiritWind]

Hi Jazzy :

IF you provided the SPECIFIC "Name" of the "Virus" and/or
the SPECIFIC "Name" of the "program" that your wife
downloaded, I could do research as to the "characteristics"
of what was on your computer ; it sounds like you did an
incomplete removal . May still be another piece of
malware which has NOT been discovered, such as a rootkit
or Trojan !?

[LiveBrianD]

Guys, if defrag and AV programs show the files, they weren't deleted from the MFT and all, they're probably just hidden like I said.

[coastie65]

One thing to try is to use Windows explorer for a know file that you think was deleted. When you set up the search parameters, be sure to include all Hidden files and such and see what comes up.

[SuperSamuraiBlades]

jazzy007, on 06 December 2011 - 06:44 PM, said:

My PC got a virus where it obscure my data on my hard drive partition. In short worlds, a program download by my wife as a Windows fixer took over my PC. Got the virus out but not before it did some harm to my PC. Many of Windows file were delete. In short, I had to reinstall Windows. No problem. Got it running, but the data on my partition was gone. I look into my D: and E: drive and it show empty or nothing. But the defrag show there is data there and so does the antivirus. The question is how to retrive that data. Most are pictures and school papers.

jazzy2945@att.net

You should probably format your hard drive partitions as well. The virus possibly did some damage to the data causing an incorrect reading from your defrag and antivirus programs.

[LiveBrianD]

BEWARE - formatting your hard drive will erase all data on it! Come to think of it, download Ubuntu, burn it to a cd, boot from that cd, and see if you can access your files from there (it's not a bad idea to transfer them to an external hard drive from there).

[Dellinsp531]

He does not need a full linux system like ubuntu which is 700MB. He can use a smaller linux like puppy (120MB) or DSL ((60MB) like I mentioned in my post above.

[geniux]

LiveBrianD, on 06 December 2011 - 06:54 PM, said:

I think it hid your files, but didn't actually delete them. Go into folder options, and set it to show hidden files. Now do they show up? If not, go back to folder options and also set it to show system files, then look again.

even if you change the explorer settings to show hidden files, it still may not show up, because the virus may have changed the NTFS permissions to not list the folder contents

[Tunz]

The above post may indicate more than just a lack of social graces. Right click on one of the affected drives, choose Properties and then the Security tab and ensure that "List folder contents" is checked for all.