Solved

Files disappeared from flash memory ... virus behaviour

Posted on 2011-02-11
14
571 Views
Last Modified: 2012-05-11
Dear Experts,

I have a flash memory with more than 1.3 GB of data. suddenly all files on the flash memory have disappeared!! I display hidden and system files but no files appeared.
 Files in the flash memory
I checked the size of the data on the flash memory and it shows as below:
 Data size on flash
This problem happened with me in before by a virus and files was recovered by running the following command:
 
attrib -r -s -h H: /s /d

Open in new window


This time it is not working with me, it seemed the virus gets stronger and it is not detected and it's effect is not recovered.
I also tried to recover the files using Files Recovery programs, but does not work. The OS dealing with these files as existing files, but can't display them!! I think something wrong with the FAT table.

please any help in this issue.

Regards,
Anas
0
Comment
Question by:ashunnag
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 5
  • 2
  • +1
14 Comments
 
LVL 17

Expert Comment

by:houssam_ballout
ID: 34873953
DID you try it on another computer?
0
 
LVL 49

Expert Comment

by:dbrunton
ID: 34874034
Try data recovery tools.

GetDataBack http://www.runtime.org/data-recovery-software.htm

Free to try.  If it sees the files you pay for the full functions.  

But do this on a machine that does not have viruses.
0
 
LVL 6

Author Comment

by:ashunnag
ID: 34874998
@houssam: yes I tried them on other PCs, but looks like FAT table corrupted on the desk.

@dbrunton: tried this but looks like recovering old deleted files not the one existing on it. the problem is that it is recognizing these files as deleted files, it recognise them as existing files but can't view them.

any help?
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
LVL 17

Expert Comment

by:houssam_ballout
ID: 34875010
so, the full version I think will let you view them...
0
 
LVL 49

Expert Comment

by:dbrunton
ID: 34875673
So try Recuva http://www.piriform.com/recuva/download and see what it can do.
0
 
LVL 6

Author Comment

by:ashunnag
ID: 34877250
No luck still the same.
did anyone know how I can read the content of FAT table?
0
 
LVL 49

Expert Comment

by:dbrunton
ID: 34878529
You could try TestDisk.

TestDisk http://www.cgsecurity.org/wiki/TestDisk

Tutorial http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

But if GetDataBack and Recuva aren't seeing anything you have serious problems.  Also look at Photorec http://www.cgsecurity.org/wiki/PhotoRec
0
 
LVL 11

Expert Comment

by:ocanada_techguy
ID: 34880028
What does it look like under Disk Management?
0
 
LVL 6

Author Comment

by:ashunnag
ID: 34881423
It looks as I have more sophisticated problem. I can't format the flash mem. now :(
0
 
LVL 49

Accepted Solution

by:
dbrunton earned 250 total points
ID: 34881458
That seems like faulty memory.  But if you could format it then you'd wipe out anything that was there.
0
 
LVL 6

Author Comment

by:ashunnag
ID: 34881465
yes I am thinking to format it then use data recovery tool to get as much of data back. but looks like wouldn't be formated.
How I can format it? in windows it says "Format can't be completed"
0
 
LVL 49

Expert Comment

by:dbrunton
ID: 34881472
Formatting will only make the problem worse.

Two methods

http://www.ehow.com/how_2006214_format-flash-drive.html
http://www.quickonlinetips.com/archives/2005/08/fix-format-usb-flash-drives/

But if you've tried and are getting that error the disk is bad.
0
 
LVL 11

Assisted Solution

by:ocanada_techguy
ocanada_techguy earned 250 total points
ID: 34884045
This could also be if the flash stick had encryption.  Depending on the OS version(s) used with it, you ought to have been prompted to "save" the encryption key when set-up.  After that, on that box it works seamlessly... but... try to mess with it on a box that does not have the encryption key and it seems like the stick is much smaller or non-existant as the area with the content is completely hidden.  It really sounds like that is your problem.  Do you recall at all anything about this stick offering to password protect back when you first used it?

With hard disk, failing to do the "safely remove" before unplugging can result in corruption, and while flash sticks are somewhat less vulnerable, sometimes a machine could have a badly written driver that does too much caching fail to write out to the drive without a "safe to remove" triggering it.  Normally Windows is supposed to detect whether the drive is removable and then adjust the behaviour accordingly, but XP is infamous for defaulting to caching for performance as default whereas Vista/7 default to optimized for safe removal.

You are correct that it's not out of the question that a malicious virus could try to corrupt a flash drive.  How many different machines have you connected it to, and have you checked all those machines to see if they have active up-to-date anti-virus and scanned with it?
0
 
LVL 6

Author Comment

by:ashunnag
ID: 34887045
looks like the flash memory is corrupted ... anyway, thanks all for assistance.

Regards,
Anas
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Are you unable to synchronize your OST (Offline Storage Table) file with Microsoft Exchange Server? Is your OST file exceeding 2 GB size limit? In Microsoft Outlook 2002 and earlier versions, there is a 2 GB size limit for the OST file. If the file …
Migration of Exchange mailbox can be done with the ExProfre.exe tool. But at times, when the ExProfre.exe tool migrates the Exchange Server user profile, it results in numerous synchronization problems. Synchronization error messages appear in the e…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question