This flash drive was used in the car for a while. This morning, after a battery problem, I have this:

  • Erased. Depending which sectors fell out - info can be restored or impossible. There is even a paid data recovery service. The easiest way to reformat. From recovery utilities I will name two Acronics, and DiskEdit (the second is very weak). The recovery process is not easy. - nick_n_a
  • one
    Try Recuva. - Qwertiy ♦
  • And there is also an option with a virus and hidden files. The console and chkdsk can prompt something. - Qwertiy ♦
  • Well, you yourself answered because of troubles with the battery. The automotive network is rated for voltage somewhere between 11-14,5v, and the microcontroller of the flash drive I think is very sensitive to jumps. Poor-quality audio equipment sometimes badly digests the voltage of a car, such glitches are obtained. I would try Low Level Format utilities - koks_rs
  • one
    Windows Explorer - not an indicator once. It may not show all files at least. Well, even with five reasons why this may be, so that fortune telling on the coffee grounds, alas. - Vladimir Martyanov

3 answers 3

A classic problem after a hidden virus.

Open cmd

 F: attrib -S -H /S /D

This command will change attributes for files and remove the "system" and "hidden" attributes from them.

  • Here's what happened: i.imgur.com/77bT2Ca.png I ’ll try to run atomically at the receiver, although it looks weird) - Anque
  • @Anhk, forum.ixbt.com/topic.cgi?id=11 Tre4177 . So it's not a virus. Just a shitty port, a shitty memory inside a flash drive, a shitty controller in the radio, a shitty power to the port. Choose any. - don Rumata
  • Not the fact that not a virus. There is a nuance ... - Qwertiy ♦
  • @Qwertiy, after the screenshot, now I tend more to the problems of software and power. But still, I encounter such a combination of glitches for the first time (again, taking into account the screenshot above). - don Rumata
  • If you google, it comes across that chkdsk did this after the virus. - Qwertiy ♦

For the FAT32 file system, the amount of used space is calculated based on the information on the used clusters from the FAT tables. The absence of files in the explorer indicates either that they are hidden / systemic, and the display of these is not included, or that there are problems in the file system (lost clusters). Well, or both, and more.

Judging by the names of the displayed files in the later screenshot, there were errors in the file system (if there was a power failure, this is easy), and chkdsk worked on the disk already in the computer (in vain did you allow it to treat the media or did not ban it, because it was not for nothing that Disc Destroyer). Sorry - the directory structure and file names are irretrievably lost. The contents of many files are correct, but supplemented to the cluster (i.e. there is a parasitic "tail") - in most cases it is not a bad thing. If there was something important, there is a chance to figure it out.

I recommend to move it all to the hard drive for further investigation, if it is necessary, of course, and reformat the flash drive to NTFS.

    Judging by the late screenshot, the point is clearly not in the virus that is hiding files, but just in case I will post my decision, all of a sudden someone will need it. This virus has two modifications. The first simply makes these files hidden and system files, and the other moves them to the e2e2~1 directory, which is not displayed either in Windows Explorer or in other file managers. For the treatment of both modifications, I developed a script that needs to be written to a USB flash drive, run and follow the prompts. Download the script . I do not publish the listing here because of possible problems with the encoding.