A Windows XP help forum. PCbanter

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

Go Back   Home » PCbanter forum » Microsoft Windows 8 » Windows 8 Help Forum
Site Map Home Register Authors List Search Today's Posts Mark Forums Read Web Partners

Folder vanishes (disappears) from an external drive for no reason



 
 
Thread Tools Rate Thread Display Modes
  #1  
Old June 19th 16, 10:52 AM posted to alt.comp.os.windows-8
Hueyduck
external usenet poster
 
Posts: 1
Default Folder vanishes (disappears) from an external drive for no reason

Hi everyone,
I'm currently helping a friend solving a mystery.

The guy has a laptop running Win8.
He connects a 2.5" external drive "Seagate BackUp plus portable drive",
with a NTFS file system and a USB3 interface.
The HDD mounts normally and my friend is able to see the file structure
in his explorer.
Then he clicks on a folder called, let's say, "Mywork - images" ( just
in cas it has an importance: other folders have names that begin in the
same manner "Mywork- sounds", "Mywork", for instance).
But instead of opening the folder, Windows gives an error message to my
friend, saying that the folder is not available on the specified place.
My friends then unplugs the HDD, plugs it again into the laptop, an then
the folder is no longer visible at all.

NB : This is not a "hidden file" attribute problem
He checks if the folder hasn't been moved by mistake: nope
He checks the drive with UndeletePus: nothing
He scans the drive with PC inspector files recovery: nothing.

Then he gives his drive to me (I run win7 ).
I just read it with "GetDataBack simple recovery" and there it is: the
missing folder is here and all the files are perfectly accessible.
And with the software, I see that another major folder had disappeared
from the root of the File System.

In order to understand what was going on, I checked something:
If I check the properties of the drive in the explorer, I see that 100Go
are occupied by datas.
But if I go in win8 explorer at the root of the logical drive and
select all files and folders , I get 75Go. The difference is, indeed,
aquivalent to the space occupied by the 2 folders only "GetDataBack"
seems to be able to see for the moment.
And if I select all the folders and file in "GetDataBack", I get a sum
of 100Go, as I should, of course.

My question is : how come?
It seems like a MFT corruption to me. GetDataBack must be reading a copy
of the MFT, but why isn't neither Win8 , neither win7 or XP able to see
that the MFT he reads is corrupted? And if the corruption is not
detected, how come the space occupied by the inivisible folders is still
allocated by the system?

It seems like windows cannot see the folders, but anotehr part of
windows knows that there is something there.

Can the sudden disappearing have something to do with the USB connection?
And how to prevent this from happening again ?
Could this be related to a hidden/unknown specification of the drive (I
know that some of them have software preinstalled on them to make Backup
more convenient, but my friend never used or installed any feature of
this kind with this drive).

I'd like to understand


I posted this here because I thought it could be OS related and the
folders disappeared while the drive was mounted on windows 8. Maybe
another forum would be more appropriate. Any guidance is welcome, of course.

Thanks for your help and have a niwe week-end.


Huey
===============================


Ads
  #2  
Old June 19th 16, 01:31 PM posted to alt.comp.os.windows-8
Paul
external usenet poster
 
Posts: 18,275
Default Folder vanishes (disappears) from an external drive for no reason

Hueyduck wrote:
Hi everyone,
I'm currently helping a friend solving a mystery.

The guy has a laptop running Win8.
He connects a 2.5" external drive "Seagate BackUp plus portable drive",
with a NTFS file system and a USB3 interface.
The HDD mounts normally and my friend is able to see the file structure
in his explorer.
Then he clicks on a folder called, let's say, "Mywork - images" ( just
in cas it has an importance: other folders have names that begin in the
same manner "Mywork- sounds", "Mywork", for instance).
But instead of opening the folder, Windows gives an error message to my
friend, saying that the folder is not available on the specified place.
My friends then unplugs the HDD, plugs it again into the laptop, an then
the folder is no longer visible at all.

NB : This is not a "hidden file" attribute problem
He checks if the folder hasn't been moved by mistake: nope
He checks the drive with UndeletePus: nothing
He scans the drive with PC inspector files recovery: nothing.

Then he gives his drive to me (I run win7 ).
I just read it with "GetDataBack simple recovery" and there it is: the
missing folder is here and all the files are perfectly accessible.
And with the software, I see that another major folder had disappeared
from the root of the File System.

In order to understand what was going on, I checked something:
If I check the properties of the drive in the explorer, I see that 100Go
are occupied by datas.
But if I go in win8 explorer at the root of the logical drive and
select all files and folders , I get 75Go. The difference is, indeed,
aquivalent to the space occupied by the 2 folders only "GetDataBack"
seems to be able to see for the moment.
And if I select all the folders and file in "GetDataBack", I get a sum
of 100Go, as I should, of course.

My question is : how come?
It seems like a MFT corruption to me. GetDataBack must be reading a copy
of the MFT, but why isn't neither Win8 , neither win7 or XP able to see
that the MFT he reads is corrupted? And if the corruption is not
detected, how come the space occupied by the inivisible folders is still
allocated by the system?

It seems like windows cannot see the folders, but anotehr part of
windows knows that there is something there.

Can the sudden disappearing have something to do with the USB connection?
And how to prevent this from happening again ?
Could this be related to a hidden/unknown specification of the drive (I
know that some of them have software preinstalled on them to make Backup
more convenient, but my friend never used or installed any feature of
this kind with this drive).

I'd like to understand


I posted this here because I thought it could be OS related and the
folders disappeared while the drive was mounted on windows 8. Maybe
another forum would be more appropriate. Any guidance is welcome, of
course.

Thanks for your help and have a niwe week-end.


Huey
===============================


There is a kind of malware, which changes one
of the file attributes. This utility reverses the
changes.

http://www.bleepingcomputer.com/download/unhide/

I do not know more about the topic than that, and
it's just a remote possibility. If you've run CHKDSK,
if there was really a problem with the $MFT corrupted,
it would be fixed by now.

Paul
  #3  
Old June 19th 16, 07:46 PM posted to alt.comp.os.windows-8
VanguardLH[_2_]
external usenet poster
 
Posts: 10,881
Default Folder vanishes (disappears) from an external drive for no reason

Hueyduck wrote:

Hi everyone,
I'm currently helping a friend solving a mystery.

The guy has a laptop running Win8.
He connects a 2.5" external drive "Seagate BackUp plus portable drive",
with a NTFS file system and a USB3 interface.
The HDD mounts normally and my friend is able to see the file structure
in his explorer.
Then he clicks on a folder called, let's say, "Mywork - images" ( just
in cas it has an importance: other folders have names that begin in the
same manner "Mywork- sounds", "Mywork", for instance).
But instead of opening the folder, Windows gives an error message to my
friend, saying that the folder is not available on the specified place.
My friends then unplugs the HDD, plugs it again into the laptop, an then
the folder is no longer visible at all.

NB : This is not a "hidden file" attribute problem


How about the 'system' file/folder attribute? Did you check attributes
on only files or also on folders?

Those "backup" external drives often come with software that can use
drivers as rootkits to hide folders and files in the files system. They
may still leave the clusters allocated in the file system to prevent
other software from using it (and overwriting the backup data). The
stupid ones just hide the allocation from the file system so it is
possible to step on top of backup/snapshot files. The driver may not
load in safe mode.

Although you wouldn't have the surreptitious driver installed in your
setup, perhaps it putzes with the file system in trying to hide the
backup file locations.

If he is not using the USB drive with some supplied backup software then
he should [first copy his file elsewhere] make sure the included backup
software is NOT installed and then reformat using NTFS (and copy back
the files).

He checks if the folder hasn't been moved by mistake: nope
He checks the drive with UndeletePus: nothing
He scans the drive with PC inspector files recovery: nothing.


Same when he boots into Windows' safe mode?

Then he gives his drive to me (I run win7 ).
I just read it with "GetDataBack simple recovery" and there it is: the
missing folder is here and all the files are perfectly accessible.
And with the software, I see that another major folder had disappeared
from the root of the File System.


Yet ran "chkdsk drive /r"?

In order to understand what was going on, I checked something:
If I check the properties of the drive in the explorer, I see that 100Go
are occupied by datas.
But if I go in win8 explorer at the root of the logical drive and
select all files and folders , I get 75Go. The difference is, indeed,
aquivalent to the space occupied by the 2 folders only "GetDataBack"
seems to be able to see for the moment.
And if I select all the folders and file in "GetDataBack", I get a sum
of 100Go, as I should, of course.


Configure Windows Explorer to show "hidden files" (with 'hidden' and
'system' attributes) and to show "protected operating system files". If
the folders were somehow marked as Windows special folders, they may not
be shown in Windows Explorer unless you make it show protected files.

You will then also see all the desktop.ini files under each folder.
Delete those files if you don't any customization of folders. Those get
created for customized folders, like for your desktop. They won't get
created if ""Remember each folder's view settings" is disabled. If that
option isn't listed, edit the registry to disable the cache
(HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Cur rentVersion\Policies\Explorer,
DWORD UseDesktopIniCache = 0). I don't know that any setting in a
desktop.ini file will make it disappear in Windows Explorer but it's
worth a shot.

https://msdn.microsoft.com/en-us/lib...(v=vs.85).aspx

That lists some attributes that can be recorded in the desktop.ini file
but not all of them. Some more are listed at:

https://hwiegman.home.xs4all.nl/desktopini.html

The bracketed entries are categories of settings. Since some deal with
shell object handling, perhaps something there could tell Windows
Explorer not to show that folder. For example:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell 32.dll,-21799

Is in one of the desktop.ini files on my desktop when I show them (one
is for your Windows account and the other is for the All Users account).
The LocalizedResourceName parameter can be used to change the folder
name to something else when viewed in Windows Explorer. Some folders
(Windows special folders) use class IDs in the registry for special
handling by Windows Explorer, like your ProgramData folder not showing
(unless you tell Windows Explorer to show system protected files). So
it is possible to use desktop.ini to use a class ID of a special folder
to manipulate how Window Explorer will handle the folder under which
that desktop.ini exists. See:

https://www.greyhathacker.net/?p=216
http://www.cchcc.net/is-desktop-ini-...is-desktop-ini

It's not just malware that can utilize desktop.ini to alter behavior.
Any software can modify desktop.ini for its special purposes. They
could add/modify entries that affect Windows Explorer's behavior or are
only for use by their software. Rather than store all folder
customization in the registry, some is in the desktop.ini file. That
way, as the file system moves (i.e., you move the USB drive to another
computer), so do the customizations.

Since this is not an OS partition and its file system for Windows but
instead an externally attached USB drive, you could scrap all the folder
customizations (delete all the desktop.ini files). If the user wants
some customizations, he can redo them and get new desktop.ini files
created in those folders.

My question is : how come?
It seems like a MFT corruption to me. GetDataBack must be reading a copy
of the MFT, but why isn't neither Win8 , neither win7 or XP able to see
that the MFT he reads is corrupted? And if the corruption is not
detected, how come the space occupied by the inivisible folders is still
allocated by the system?

It seems like windows cannot see the folders, but anotehr part of
windows knows that there is something there.

Can the sudden disappearing have something to do with the USB connection?
And how to prevent this from happening again ?
Could this be related to a hidden/unknown specification of the drive (I
know that some of them have software preinstalled on them to make Backup
more convenient, but my friend never used or installed any feature of
this kind with this drive).

I'd like to understand

I posted this here because I thought it could be OS related and the
folders disappeared while the drive was mounted on windows 8. Maybe
another forum would be more appropriate. Any guidance is welcome, of course.


Unless he needs specific permissions, I would remove them all.
Right-click on the root folder (on the drive) and take ownership of it
and propagate it to all children (subfolders and files). There is a
Take Ownership tool (adds itself in the registry as a script that runs
cacls on folder and file objects) if you don't want to use the
permissions dialog (which Microsoft made clumsy). Then change
permissions on the root folder (and include propagation to its children)
as to who has what permissions. Add the Everyone security group (and
the Administrator account, just in case) and give them full permissions
on that root folder and all its children. Obviously to change ownership
and permissions requires the user log under a Windows account in the
Administrators security group (i.e., it has admin permissions).

The Everyone security group includes all users. The SID for the
Administrator account is the same in every instance of Windows; see:

https://msdn.microsoft.com/en-us/lib...(v=vs.85).aspx
https://support.microsoft.com/en-us/kb/243330

So you can change permissions to add the Everyone group and
Administrator account (and remove others) on your computer on the
folders and files and they will apply under other instances of Windows.
 




Thread Tools
Display Modes Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off






All times are GMT +1. The time now is 04:23 PM.


Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Copyright ©2004-2024 PCbanter.
The comments are property of their posters.