Page 1 of 1
An odd request from a user.
Posted: February 8th, 2017, 3:12
by hack3rcon
Hello.
I have a 1TB external HDD with Seagate brand and user said me that he lost some of files and folders because of malware. When I open the HDD then I just see the shortcuts of his files and folders but not the real file and folders. What happened to them? Some malware, hidden folders and create an infected shortcuts and...We scanned HDD via an Antivirus and now it is cleaned but what happened to files and folders?
Thank you.
Re: An odd request from a user.
Posted: February 8th, 2017, 3:23
by jeremyb
RansomeWare?
Re: An odd request from a user.
Posted: February 8th, 2017, 3:43
by hack3rcon
jeremyb wrote:RansomeWare?
I guess not. The RansomeWare encrypt files and folders but my problem is that just shortcut of files and folders exist not Encrypt version of them!!!
Re: An odd request from a user.
Posted: February 8th, 2017, 8:23
by sourcerer
Where do the shortcuts point to?
Re: An odd request from a user.
Posted: February 8th, 2017, 8:40
by hack3rcon
sourcerer wrote:Where do the shortcuts point to?
They are 0 byte size.
But problem solved and no file deleted. In HDD, I just find some folders like "FOUND.000" and etc that files are there
Re: An odd request from a user.
Posted: February 8th, 2017, 10:55
by labtech
Somebody ran chkdsk on the drive. Lucky the files are still good.
Re: An odd request from a user.
Posted: February 8th, 2017, 11:02
by lcoughey
I wish Microsoft would delete chckdsk or, at the very least, make a backup/undo file of all changes made to the MFT.
Re: An odd request from a user.
Posted: February 8th, 2017, 13:52
by labtech
lcoughey wrote:I wish Microsoft would delete chckdsk or, at the very least, make a backup/undo file of all changes made to the MFT.
That would be the best thing ever.
Re: An odd request from a user.
Posted: February 13th, 2017, 12:55
by scratchy
labtech wrote:lcoughey wrote:I wish Microsoft would delete chckdsk or, at the very least, make a backup/undo file of all changes made to the MFT.
That would be the best thing ever.
Agreed, ... and it could also do with having some kind of timeout followed by a warning when it is taking longer than expected to check a block.
Re: An odd request from a user.
Posted: February 13th, 2017, 23:28
by hack3rcon
lcoughey wrote:I wish Microsoft would delete chckdsk or, at the very least, make a backup/undo file of all changes made to the MFT.
It is not a good tool?
Re: An odd request from a user.
Posted: February 13th, 2017, 23:51
by jermy
Definitely not
Re: An odd request from a user.
Posted: February 14th, 2017, 11:56
by labtech
hack3rcon wrote:lcoughey wrote:I wish Microsoft would delete chckdsk or, at the very least, make a backup/undo file of all changes made to the MFT.
It is not a good tool?
In general, for its real purpose, yes. However, people mistakenly use it in the wrong circumstances, where it causes more or complete file damage. It is effective in certain conditions only. As far as data recovery goes, not recommended, ever.