{"id":991,"date":"2025-06-03T22:00:00","date_gmt":"2025-06-03T14:00:00","guid":{"rendered":"https:\/\/www.devhjz.com\/?p=991"},"modified":"2025-06-05T00:12:39","modified_gmt":"2025-06-04T16:12:39","slug":"23","status":"publish","type":"post","link":"https:\/\/www.devhjz.com\/en-us\/archives\/23\/","title":{"rendered":"Practice of recovering hidden file data after a virus on a USB flash drive"},"content":{"rendered":"<p class=\"wp-block-paragraph\">This article is a summary of practical experience, a detailed account of the problems that may be encountered, and give the solution. In this paper, for the U disk after the virus in the file explorer U disk capacity has occupied, and open the file shows that the situation of data recovery.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">current situation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After inserting the USB flash drive into the computer, the antivirus software reported that the original files and folders were hidden, and a large number of .exe (executable) files disguised as folders with the same name appeared. Using DiskGenius to query, the original files on the USB flash drive still exist, but the file attributes are marked as H (Hide) S (System), so they cannot be displayed directly in File Explorer.<\/p>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-8f761849 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\"><div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/static.devhjz.com\/Web\/Blog\/img\/Posts\/23\/1.png\" alt=\"\"\/><figcaption class=\"wp-element-caption\">USB flash drive space is occupied<\/figcaption><\/figure>\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\"><div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" src=\"https:\/\/static.devhjz.com\/Web\/Blog\/img\/Posts\/23\/2.png\" alt=\"\" style=\"width:359px;height:auto\"\/><figcaption class=\"wp-element-caption\">Documents cannot be displayed directly<\/figcaption><\/figure>\n<\/div><\/div>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Solution Ideas and Methods<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Make sure that the \"AutoPlay\" function of your computer is turned off before performing the following operations to avoid endangering the equipment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">1. Remove viruses from the USB flash drive, by running antivirus software to scan the USB flash drive and remove potential viruses.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">2. Try to run a command prompt as administrator and execute the following command to recover the file:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Note: You can press \"Windows Button + R\" to open the Run window, type \"cmd\", and then press \"Ctrl + Shift + Enter\" to open the Command Prompt as administrator. to open the Command Prompt as administrator.<strong>Before running, you need to replace the \"X\" in the command with the drive letter of the USB flash drive, such as \"F\" in this case.<\/strong>When finished, press \"Enter\" to run.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>attrib -s -h \/s \/d X:\\*. *<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">In addition to using the command prompt, it is also possible to operate with the help of UltraFileExternal, which has a graphical interface.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" src=\"https:\/\/static.devhjz.com\/Web\/Blog\/img\/Posts\/23\/3.png\" alt=\"\" style=\"width:504px;height:auto\"\/><figcaption class=\"wp-element-caption\">UltraFileExternal Software<\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">With UltraFileExternal, you can first click \"Folders\" (\u2460 above) to select the folder you want to change the permissions, then click \"File Properties\" button (\u2461 above) to make the checkboxes in the area \u2462 white, and uncheck all the boxes. Select the folder you want to change the permissions to. Select \"Manipulate Files and Folders\" in the \u2463 combo box and click \"Start\".<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the USB flash drive files resume normal display after this step is completed, then congratulations, the USB flash drive data is successfully recovered. Otherwise, please continue to read below.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this case, running the attrib command encountered the<strong>insufficient authority<\/strong>If the problem is caused by a virus file that has not been completely deleted, the file can be extracted directly by DiskGenius.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" src=\"https:\/\/static.devhjz.com\/Web\/Blog\/img\/Posts\/23\/4.png\" alt=\"\" style=\"width:504px;height:auto\"\/><figcaption class=\"wp-element-caption\">DiskGenius software<\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">After opening the software, find and click on the left side of the disk drive you need to extract files (Figure 1 below), and then click the \"Browse Files\" tab above (Figure 2 below), you can display all the files on the USB flash drive. At this point, we found that the file attribute is HS.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" src=\"https:\/\/static.devhjz.com\/Web\/Blog\/img\/Posts\/23\/5.png\" alt=\"\" style=\"width:504px;height:auto\"\/><figcaption class=\"wp-element-caption\">Listing files with DiskGenius<\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Select the file you want to extract in the following area (you can hold down \"Ctrl\" to select more than one, as shown in the following figure \u2460), and then right-click, click \"Copy to Specified Folder\" (as shown in the following figure \u2461).<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" src=\"https:\/\/static.devhjz.com\/Web\/Blog\/img\/Posts\/23\/6.png\" alt=\"\" style=\"width:504px;height:auto\"\/><figcaption class=\"wp-element-caption\">Extracting files<\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">In the pop-up window, select the location where the extracted files are stored.<strong>Be careful not to put it on the USB flash drive being operated.<\/strong>.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" src=\"https:\/\/static.devhjz.com\/Web\/Blog\/img\/Posts\/23\/7.png\" alt=\"\" style=\"width:504px;height:auto\"\/><figcaption class=\"wp-element-caption\">Choosing the right storage location<\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Keep the following options as default, or adjust them according to your needs, click \"OK\" button to start extraction. During the extraction process, pay attention to the possible error message pop-up windows.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" src=\"https:\/\/static.devhjz.com\/Web\/Blog\/img\/Posts\/23\/8.png\" alt=\"\" style=\"width:504px;height:auto\"\/><figcaption class=\"wp-element-caption\">Select the appropriate file storage option<\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Wait patiently, when the file extraction is finished, you can click the \"Open Folder\" button to quickly access the location of the extracted files, or click the \"Finish\" button to exit the wizard.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" src=\"https:\/\/static.devhjz.com\/Web\/Blog\/img\/Posts\/23\/9.png\" alt=\"\" style=\"width:504px;height:auto\"\/><figcaption class=\"wp-element-caption\">File extraction completion prompt<\/figcaption><\/figure>\n<\/div>\n\n\n<h2 class=\"wp-block-heading\">Problems likely to be encountered<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If the file cannot be displayed in the folder after extracting the file via DiskGenius, you can use UltraFileExternal or attrib command to operate on the file to recover it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">postscript<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-red-color\">Data is priceless, proceed with caution!<\/mark><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>","protected":false},"excerpt":{"rendered":"<p>This article is a summary of practical experience, a detailed account of the problems that may be encountered, and give the solution. In this paper, for the U disk after the virus in the file explorer U disk capacity has occupied, and open the file shows that the situation of data recovery is empty. The situation U disk inserted into the computer after the antivirus software reported viruses, the original files and folders are hidden, there are a large number of files disguised as the same name ...<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[28],"topic":[],"class_list":["post-991","post","type-post","status-publish","format-standard","hentry","category-some-tech","tag-28"],"_links":{"self":[{"href":"https:\/\/www.devhjz.com\/en-us\/wp-json\/wp\/v2\/posts\/991","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devhjz.com\/en-us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devhjz.com\/en-us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devhjz.com\/en-us\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devhjz.com\/en-us\/wp-json\/wp\/v2\/comments?post=991"}],"version-history":[{"count":0,"href":"https:\/\/www.devhjz.com\/en-us\/wp-json\/wp\/v2\/posts\/991\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devhjz.com\/en-us\/wp-json\/wp\/v2\/media?parent=991"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devhjz.com\/en-us\/wp-json\/wp\/v2\/categories?post=991"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devhjz.com\/en-us\/wp-json\/wp\/v2\/tags?post=991"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.devhjz.com\/en-us\/wp-json\/wp\/v2\/topic?post=991"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}