USB Flash Drive now missing Folder of Documents ; How to recover this Folder ?

[Our Man in the Tropics]

Hi Fellow Thaivisa.com Posters,

 

Preface

I am only basic knowledgeable & understanding & skillful with computers & computer software & peripherals.

.............................................................................................................................................

 

The actual Problem ;

 

I have been using a USB Flash Drive on both :

MS Windows 7 in Notebook A

Linux [ Debian ] in Notebook B

 

Recently, I have been using only Notebook B.

 

Notebook B ;

Upon "shutting off" or "restarting" this computer, by default [ And, not of my choice ] :

all files are gone

all Bookmarks are gone

all History is gone

 

Thus, to retain my documents & bookmarks, I must store into external storage device ;

And, for this purpose, I have been using a USB Flash Drive.

 

And, even more recently, because I have physical problem of the only USB ports available being too closely adjacent to each other for insertion of 2 of my particular USB plugs,- I resort now to using USB HUB.

And, I usually turn off button of port with USB Air-Card before I turn on USB Flash Drive for storage of session's documents & bookmarks.

Thus, very rarely has it been that Internet is on whilst USB Flash Drive turned on.

 

I have been doing deep housekeeping of the USB Flash Drive recently.

Some of this involved I deleting folders.

I recall a folder with many sub-folders of documents that I indeed wish to keep & thus would not intentionally delete :

This folder contains mainly :

Libre Office Wordprocessing .odt doc.s

Adobe Acrobat PDF doc.s ; Downloads only

 

But, now this Folder, & probably more folders & documents, have disappeared from the USB Flash Drive.

 

Here's is hoping that I get the usual great help from this forum.

 

NB

I wish initially to get as much insight as possible from this forum.

Then I must analyze very carefully ;

 

Thanking u,

 

Our Man in the Tropics

[KittenKong]

If your files can be recovered at all then TestDisk can probably do it:

 

http://www.cgsecurity.org/wiki/TestDisk

 

Read the instructions very carefully.

 

For future reference: one copy of anything important is never enough. You should have at least two and preferably three, and ideally stored in completely different places (online, in another building etc).

[Our Man in the Tropics]

59 minutes ago, KittenKong said:

If your files can be recovered at all then TestDisk can probably do it:

 

http://www.cgsecurity.org/wiki/TestDisk

 

Read the instructions very carefully.

 

For future reference: one copy of anything important is never enough. You should have at least two and preferably three, and ideally stored in completely different places (online, in another building etc).

Much thanks KittenKong,

 

I endeavor to read the instructions very carefully ; As u advise.

Methinks that I am about to enter a very steep learning curve.

 

If u think that I should try to understand anything in particular on this journey from this link, please feel free to inform me.

 

It did occur to me that the many solutions offered in Google search prior to I creating this thread might very well be trojans ; incl. ransom-ware.

 

Regards,

 

Our Man in the Tropics

[Oxx]

Hope you can recover your files and it's not that the USB drive has failed (which happens a lot).

 

To protect yourself in future, I'd suggest reinstalling Debian on the device so that it keeps your documents between reboots.  Then set up an automatic backup to the "cloud".  For that I use rclone to back up to Google Drive, run as a cron job once a day (though, of course, you could run it more frequently).  It's pretty trivial to set up if you read the instructions carefully.  It can also back up to the likes of Amazon Drive, Microsoft OneDrive, DropBox and loads of others.  If you wanted you could back up to more than one of these.

 

https://rclone.org/

 

 

[Our Man in the Tropics]

Ref.

Oxx

"Hope ... it's not that the USB drive has failed (which happens a lot)."

 

Q.s :

1_

How can I determine if this is the situation ?

2_

If this situation is so, what can I do ?

 

Our Man in the Tropics

[KittenKong]

Just now, Our Man in the Tropics said:

Q.s :

 

1_

How can I determine if this is the situation ?

 

If DiskPart cannot see the drive then it is most likely dead. Try DiskPart before anything else. Do NOT attempt to write to the drive or to do anything else with it at all.

 

 

1 minute ago, Our Man in the Tropics said:

2_

If this situation is so, what can I do ?

 

Nothing.

[Our Man in the Tropics]

12 minutes ago, KittenKong said:

 

If DiskPart cannot see the drive then it is most likely dead. Try DiskPart before anything else. Do NOT attempt to write to the drive or to do anything else with it at all.

 

 

 

Nothing.

But, if it were the FBI,- I reckon they could ;

Joking aside, I believe that the info. could be recovered because u never hear of government authorities saying that they could not recover.

 

Edited November 2, 2017 by Our Man in the Tropics

[Our Man in the Tropics]

13 minutes ago, KittenKong said:

If DiskPart cannot see the drive then it is most likely dead. Try DiskPart before anything else. Do NOT attempt to write to the drive or to do anything else with it at all.

I am still using the drive for to backup fresh documents.

 

Best, I switch to another USB exteral drive so for that role & put aside the USB pending using DiskPart ?

 

By the way, why is DiskPart available for free ? ; Well, seemingly for free anyway ?

 

Our Man in the Tropics

[KneeDeep]

1 hour ago, Our Man in the Tropics said:

I am still using the drive for to backup fresh documents.

 

Best, I switch to another USB exteral drive so for that role & put aside the USB pending using DiskPart ?

 

By the way, why is DiskPart available for free ? ; Well, seemingly for free anyway ?

 

Our Man in the Tropics

 

What??!!

 

This you should NEVER  do. Otherwise you will likely overwrite the folder, making it unrecoverable.

 

Explanation thus; When you delete something, in fact you do not delete it, but only the path leading to it. It is still there, but you cannot see how to get to it.

 

But if you continue to use the drive, you might actually overwrite the folder.

 

So STOP! Possibly already too late.

[KneeDeep]

If TestDisk/PhotoRec seems to complicated to you, you can choose a more simple solution; https://www.piriform.com/recuva

 

But NEVER choose to write back to the drive. For all intents and purposes, that drive is Read Only until you recover the folder's content.

[Our Man in the Tropics]

 

Doing in ignorance appears to be a never ending pit.

AND

Essential learning appears to be a never-ending pit.

 

I am more than "knee-deep" now in the 2 pits.

 

OK ; I will switch to another USB Flash Drive.

 

Thanks KneeDeep

 

Our Man in the Tropics

[Oxx]

2 hours ago, Our Man in the Tropics said:

Ref.

Oxx

"Hope ... it's not that the USB drive has failed (which happens a lot)."

 

Q.s :

1_

How can I determine if this is the situation ?

2_

If this situation is so, what can I do ?

 

Our Man in the Tropics

 

Personally I would attempt to see the drive using gparted.  If gparted can't see it, you've lost your data.  Sorry.

 

Alternatively you can try:

 

sudo blkid | grep sd

 

Then look for the line containing something like [sdd] - you want the 3 characters inside the brackets.

 

Then try

 

sudo fdisk /dev/sdd (replace sdd with what you found with the previous command).

 

If it's failed you'll probably see:

 

fdisk: unable to open /dev/sdd: No medium found

Edited November 2, 2017 by Oxx

[Our Man in the Tropics]

Just now, I copied / tried to copy all that is presented on USB Flash Drive onto an external Hard Disk Drive ;

 

Having done that, apparently, I notice that the amount of files is less in the copy version.

 

Then, when I look at the contents, I notice already certain important folders missing in the copy version

 

So, I went back into the USB Flash Drive so as to check if they missing from there also ;

To my dismay, they are now missing from the original source too ;

Except, upon viewing hidden files within USB Flash Drive, I notice :

some of the files are now present as hidden files

some of the folders are now present as hidden folders ;

But these folders are missing :

most of the contents

all of the contents

 

I LOOKS LIKE SOMETHING IS EATING UP THE CONTENTS OF MY FOLDERS

 

 

[Oxx]

6 minutes ago, Our Man in the Tropics said:

I LOOKS LIKE SOMETHING IS EATING UP THE CONTENTS OF MY FOLDERS

 

That's pretty classic malware behaviour.  Likely you've got the same malware on your Windows machine if I'm right.

[Our Man in the Tropics]

It is a Linux based only laptop that I use for many months mainly ;

No Anti-Malware software installed.

Edited November 2, 2017 by Our Man in the Tropics

[KittenKong]

5 hours ago, Our Man in the Tropics said:

But, if it were the FBI,- I reckon they could ;

Joking aside, I believe that the info. could be recovered because u never hear of government authorities saying that they could not recover.

 

With the proper resources it may be possible, but this is beyond the scope of the average end-user. You should consider the drive dead if TestDisk cant read it.

 

[KittenKong]

5 hours ago, KittenKong said:

If DiskPart cannot see the drive then it is most likely dead. Try DiskPart before anything else. Do NOT attempt to write to the drive or to do anything else with it at all.

 

Dear me. For "DiskPart" read "TestDisk". The rest of what I wrote was correct. Sorry about that.

[KittenKong]

13 minutes ago, Oxx said:

That's pretty classic malware behaviour.  Likely you've got the same malware on your Windows machine if I'm right.

 

I dont think so. Crypto/ransom software normally leaves the file and folder names intact but corrupts the file content.

[Our Man in the Tropics]

12 minutes ago, KittenKong said:

 

With the proper resources it may be possible, but this is beyond the scope of the average end-user. You should consider the drive dead if TestDisk cant read it.

 

I started to venture into reading TestDisk ;

But, I am out of my depth with understanding what they are :

informing

recommending

But, I aim to continue to study what they say ;

However, I will not enact anything until I understand as much as I can during the week ;

Then, I will resume with more person-to-persons enquiries.

..................................................................................................................................

 

However, it appears now that I am victim of Malware Attack ;

Please see prior post by me & the reply by Oxx.

 

I guess that my External Hard Drive is infected now.

 

What to do ?

[Oxx]

1 hour ago, KittenKong said:

 

I dont think so. Crypto/ransom software normally leaves the file and folder names intact but corrupts the file content.

 

There was some malware doing the rounds in Thailand 3 or 4 years ago which hid files by extension.  Transferred by USB, if I remember correctly.  Can't remember its name.  Didn't spread much beyond Thailand.  Had to sort out one friend's computer.  Once I figured out what was going on, it wasn't too difficult to fix.  There wasn't any demand for payment.

[howto]

To the OP,

you have a *nix machine but not good on the 'command line',

 

I suggest the following ,,,

 

1 - mount the usb thumb

2 - using 'whatever' in *nix

   change all DIR + FILE "ATTRIBUTES'' to

- NOT Read Only

- NOT System

- NOT Hidden

(perhaps other attributes, I'm not a *nix expert, others can help)

Once above is done ,,,

3 - examine the usb thumb, using the 'file explorer' or such ,,,

Check the DIR's and their file contents.

 - - pay attention if any file 'extension' has changed.

 - - open some of the files with whatever app that created them.

DO NOT MODIFY ANY FILE.
DO NOT WRITE TO THE USB THUMB

 

4 - backup (or perhaps copy) all contents to another media
(others can tell you how)

5 - check that backup, then dismount it, set it aside
6 - run a recover app on the USB thumb in question ,,,
*** you will need an additional usb thumb to 'write' recovered files to.

 

Maybe you will be lucky.

 

The issues you described, while 'could be' malware ,,,

can be also be caused by 'file system corruption',

- the usb thumb 'disconnected' during a 'write operation'

- the usb thumb was not properly 'dismounted'

- the usb port is dirty

- the usb thumb is failing  (i hate kingston)

 

Others can assist you for most of the above ,,,

and for now, DO NOT RUN 'CHKDSK /R' -OR- 'CHKDSK /F'

 

Best of luck

- howto

 

[SheungWan]

Once one realises how vulnerable one is storing anything on a flash drive, which is doubly enhanced if extensively travelling, time for a move to the cloud. Or at least cloud backup.

[Our Man in the Tropics]

Thanks to every poster thus far for all very edifying replies ;

 

Each of them necessitate that one be of respective knowledge, understanding, & skill.

That will take some time for me to achieve.

 

I consulted a very learned friend tonight ;

 

He thinks that my problem could be :

 

1_

the fact that I am using a USB hub

 

2_

the sad fact that one's USB Flash Drive in Thailand could be "a Mickey Finn" in so far as :

 

2_1

its "actual"capacity would be much less than its "stated" capacity but the fraudster-manufacturers manipulate the EPPRON [ or similar sounding word or acronym ] so that computer being used does indeed think it the stated but over-stated capacity, & thus there comes a stage when new files replace existing files.

 

2_2

it is not even of the good brand that it meant to be ;

My case ;

It is meant to be a Sandisk.

 

3_

the USB Flash Drive could be faulty.

 

I will attend to investigating 1_ [ above ] soon.

 

Our Man in the Tropics

Edited November 3, 2017 by Our Man in the Tropics

[Our Man in the Tropics]

Just tried the USB Flash Drive directly in the computer port ;

Alas, no improvement ;

And, I think that even less number of files.

 

The USB Flash Drive is a Sandisk 8 GB ;

 

According to the Properties Feature, it currently has 2.6 GB of data in use.

 

Hidden Folders

Now have a "Period" or "Full-Stop" as very 1st character & then followed by the name of the Folder.

Most of those "Period" / "Full-Stop" Folders have either :

no contents

or

2 folders

 

Hidden Files that are not in dedicated Folders

Have as very 1st charters & then followed by the name of the File [ And, if memory serves me correctly, the names not complete as were original names ; I only think ; Because, the USB Flash Drive is not attached to computer now ], a number or letter + a "sea-wave" symbol.

 

 

Edited November 3, 2017 by Our Man in the Tropics

[Oxx]

5 hours ago, Our Man in the Tropics said:

Hidden Files that are not in dedicated Folders

Have as very 1st charters & then followed by the name of the File

 

The way that FAT (the shoddy Microsoft file system that is almost certainly installed on your USB) deletes files by changing the first character of the file name to the character 0xE5.  That's probably what you're seeing.

[Our Man in the Tropics]

6 hours ago, Oxx said:

 

The way that FAT (the shoddy Microsoft file system that is almost certainly installed on your USB) deletes files by changing the first character of the file name to the character 0xE5.  That's probably what you're seeing.

Ref.

My computer

It has Linux only.

And, the set-up -- & it not intentional, but rather a nuisance ; Or, perhaps it can be a positive for security if user backs up their files & bookmarks to ... USB Flash Drive 8-) -- does not retain any files or bookmarks after computer is closed down.

 

Ref.

My USB Flash Drive

It has MS DOS ; I recall

So, I presume it is FAT File System.

 

Q.

If the FAT File System is deleting files, can I recover them after shutting down computer ?

 

Edited November 4, 2017 by Our Man in the Tropics

[Oxx]

30 minutes ago, Our Man in the Tropics said:

Q.

If the FAT File System is deleting files, can I recover them after shutting down computer ?

 

It's not FAT deleting the files.  A program has told FAT to delete the files.  That could be malware.  It could be something you've done yourself by mistake.

 

Your best bet is probably to get to grips with one of the Windows file recovery utilities.  You may not get the exact file names back, but you shouldn't lose all your data.

 

However, since you're still seeing the files (albeit hidden), why not try copying one from the thumbdrive to your harddrive, then rename it on the hard drive (changing the first character of the name) and (if necessary) making it not hidden (again, on the harddrive).  Then try opening it.  If that works, you might have a strategy for recovering more of your files.

[Our Man in the Tropics]

1 hour ago, Oxx said:

 

It's not FAT deleting the files.  A program has told FAT to delete the files.  That could be malware.  It could be something you've done yourself by mistake.

 

Your best bet is probably to get to grips with one of the Windows file recovery utilities.  You may not get the exact file names back, but you shouldn't lose all your data.

 

However, since you're still seeing the files (albeit hidden), why not try copying one from the thumbdrive to your harddrive, then rename it on the hard drive (changing the first character of the name) and (if necessary) making it not hidden (again, on the harddrive).  Then try opening it.  If that works, you might have a strategy for recovering more of your files.

Computer problems are overwhelming for me ;

That is my usual reaction anyway.

So, I am not the best at recalling the exactitudes.

................................................................

I recall -- ? -- from fleeting perusals that :

 

hidden folders do offer up some documents for viewing

 

hidden files do offer up some documents for viewing

................................................................

 

But .... :

 

many crucial folders are not visible even with Hidden View turned on

 

many crucial files are not visible even with Hidden View turned on

...................................................................
 

Also, the folders with the more personal + private + valuable naming are incrementally the 1st to disappear ;

But, at this stage -- "the not really knowing" stage -- that phenomenon may be just coincidence rather than indicate :

malware ?

incl.

keylogger activity ?

Edited November 4, 2017 by Our Man in the Tropics

[OneMoreFarang]

This is a very good and free program to retrieve any lost data:

http://www.cgsecurity.org/wiki/PhotoRec

But, at least last time I used it maybe a year or two ago, it was more a program for experts and not for normal users.

Good luck!

[JamJar]

15 hours ago, OneMoreFarang said:

This is a very good and free program to retrieve any lost data:

http://www.cgsecurity.org/wiki/PhotoRec

But, at least last time I used it maybe a year or two ago, it was more a program for experts and not for normal users.

Good luck!

 

It's not at all difficult to use. TestDisk/PhotoRec from the same person.

 

When you download, save and unzip the contents of the file, you should run the application qphotorec(from memory).

It has a relatively easy to understand GUI.

You can scan the drive for specific file extensions.

 

I'm on holiday, so can't get too involved.