Hueyduck wrote:
Hi everyone,
I'm currently helping a friend solving a mystery.

The guy has a laptop running Win8.
He connects a 2.5" external drive "Seagate BackUp plus portable drive",
with a NTFS file system and a USB3 interface.
The HDD mounts normally and my friend is able to see the file structure
in his explorer.
Then he clicks on a folder called, let's say, "Mywork - images" ( just
in cas it has an importance: other folders have names that begin in the
same manner "Mywork- sounds", "Mywork", for instance).
But instead of opening the folder, Windows gives an error message to my
friend, saying that the folder is not available on the specified place.
My friends then unplugs the HDD, plugs it again into the laptop, an then
the folder is no longer visible at all.

NB : This is not a "hidden file" attribute problem
He checks if the folder hasn't been moved by mistake: nope
He checks the drive with UndeletePus: nothing
He scans the drive with PC inspector files recovery: nothing.

Then he gives his drive to me (I run win7 ).
I just read it with "GetDataBack simple recovery" and there it is: the
missing folder is here and all the files are perfectly accessible.
And with the software, I see that another major folder had disappeared
from the root of the File System.

In order to understand what was going on, I checked something:
If I check the properties of the drive in the explorer, I see that 100Go
are occupied by datas.
But if I go in win8 explorer at the root of the logical drive and
select all files and folders , I get 75Go. The difference is, indeed,
aquivalent to the space occupied by the 2 folders only "GetDataBack"
seems to be able to see for the moment.
And if I select all the folders and file in "GetDataBack", I get a sum
of 100Go, as I should, of course.

My question is : how come?
It seems like a MFT corruption to me. GetDataBack must be reading a copy
of the MFT, but why isn't neither Win8 , neither win7 or XP able to see
that the MFT he reads is corrupted? And if the corruption is not
detected, how come the space occupied by the inivisible folders is still
allocated by the system?

It seems like windows cannot see the folders, but anotehr part of
windows knows that there is something there.

Can the sudden disappearing have something to do with the USB connection?
And how to prevent this from happening again ?
Could this be related to a hidden/unknown specification of the drive (I
know that some of them have software preinstalled on them to make Backup
more convenient, but my friend never used or installed any feature of
this kind with this drive).

I'd like to understand


I posted this here because I thought it could be OS related and the
folders disappeared while the drive was mounted on windows 8. Maybe
another forum would be more appropriate. Any guidance is welcome, of
course.

Thanks for your help and have a niwe week-end.


Huey
===============================

There is a kind of malware, which changes one
of the file attributes. This utility reverses the
changes.

http://www.bleepingcomputer.com/download/unhide/

I do not know more about the topic than that, and
it's just a remote possibility. If you've run CHKDSK,
if there was really a problem with the $MFT corrupted,
it would be fixed by now.

Paul