• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 660
  • Last Modified:

Recovering files from a Virus-infected Hard Drive Windows XP

Our clerk has a virus-infected hard drive on a home computer that we provided for off-site work (so I have to support it.)  Crash was over the weekend, and she took it to a local guy first since I was not available.

Anyway, now I have the drive.  My usual method for dealing with this situation is to add the infected drive as a slave on a working computer.  I did so, and when I booted the computer, it ran Scan Disk on the new drive.  I saw some index issues that were apparently repaired, got busy with something else, and suddenly got the login screen.  It was much quicker than I expected, but apparently everything was working fine.  The bad drive showed up as drive D.

In MY COMPUTER, Drive D was visible, but displayed no files.  On a whim, I had my antivirus (Kaspersky) do a "Scan Now" on the disk.  It displayed the files being scanned, and they were all there.

So here is my problem.  The files still exist on the harddrive, but don't display so I can pull them off.  Is there a way I can still get to them?
1 Solution
Go to the D drive and folder options/show hidden.

The drive is infected.  Once you rescue your files, get it back in the machine and run malwarebytes and combofix.  Before running combofix disable AV and AS software.


Scott CSenior Systems EnginerCommented:
Leave the drive connected to your computer and boot with a Knoppix disk.


You then should be able to either copy the files to your hard drive or a flash drive.

After the files are copied and safe you can then format the infected drive and reinstall.

On my home computer I have a 160GB drive installed with Knoppix and when I get an infected drive from someone I connect their drive to my computer and boot into Knoppix to access it.

This protects my real hard drives from infection and works very well.
Lee W, MVPTechnology and Business Process AdvisorCommented:
I agree, it sounds like the files were all hidden and your computer hasn't been set to show hidden files.  Adjust the Explorer options to show all hidden files and you should see everything.  (My usual config for any machine *I* work from is in the image below).

Explorer Settings
srsdtechAuthor Commented:
Wow.  I can't believe it was that easy.  I never would have thought of the hidden filese thing.  One more trick for my book.

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now