0

I have a large pictures folder, most of then "bulk" downloaded using Hitomi Downloader, DownThemAll and similar. Yesterdary I ran a Powershell command I always use to rename the last downloaded files and found the folder empty (aside the renamed files). I'm not sure how and when the files and subfolders dissapeared, but Windows shows the folder as empty, 0 bytes size. It must have happend at most one week ago. I suspected of the Powershell command, the Hitomi task cleaning process or a failed undesired cut operation.

I have the hidden files visible (File Options > View > Hidden files) and rebuilt Windows file index (Indexing Options > Advanced Options > Rebuild). I tried several recovery tools like Recuva, Disk Drill and Do Your Data Recovery, but none of those found deleted files in that folder. I've also tried to search some of the files and folders in the whole disk but found nothing.

The files must be somehow hidden there because the deletion or moving of such a large folder (several GB) would have been noticeable with a progress modal and because the drive available space don't seem to have changed.

What else could I do? Is there another tool to list "hidden" files?

Note: Powershell rename command I used. I tested it later in another folder without errors.

Get-ChildItem *.* | select FullName, Extension, @{name='md5'; expression={(Get-FileHash $_ -Algorithm md5).Hash}} | foreach {Rename-Item $_.FullName -NewName "$($_.md5)$($_.extension)"}
adrianjgp
  • 3
  • Likely, it's unrecoverable, since a week might have gone by, and data has been written to disk (e.g., the huge Search Index!), overwriting the areas where the files had been kept. A commercial data recovery service might be able to recover some files, at some expense. If you have a disk image, use that to recover data. If not, consider making images periodically to avert such total loss. – DrMoishe Pippik Oct 04 '23 at 16:01
  • If the files were somehow accidentally deleted and this is a SSD then they're beyond recovery anyway (TRIM). – Joep van Steen Oct 04 '23 at 17:37
  • I can't use the MD5 switch per some FIPS compliance algorithm since that's enforced in the environment I tested. But here's an example of what works for me using SHA256 in case it helps. Basically, use the -Force parameter on Get-ChildItem to include system and hidden files Get-ChildItem -Path *.* -File -Force | select FullName, Extension, @{name='md5'; expression={(Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash}}. Some protected and/or system files may not give you a hash though per NTFS ACL restrictions from what I see in testing, might need run under nt authority\system. – Vomit IT - Chunky Mess Style Oct 05 '23 at 12:02

1 Answers1

0

Open a cmd prompt, navigate to that directory and use dir /A:SH, full syntax here with more verbose explanation that this shows files with system (Hidden by default) and "hidden" file attributes. If they do not show there, they are not "Hidden". There is no other real way to hide files in windows.

If actually deleted there are ways to recover *Sometimes, some files" such as ontrack data recovery's free tool. I know you said you tried some, but I have had ontrack succeed where others have failed.

Note that depending on how heavily the drive has changed since deletion (if deleted) that the recovery may be more difficult. It is best to do this fast if you determine you need to.

GeneMoody-Action1
  • 215
  • The result of the DIR command was a single "File Not Found" line. I will try the Ontrack tool. – adrianjgp Oct 04 '23 at 16:22
  • That pretty much confirms they are not conceivably hidden. They therefore must have been moved or deleted. If no backup and no recovery, not good news. Since your powershell was getting . did any of the folders have . in them? Otherwise the script would not have acted on them at all. – GeneMoody-Action1 Oct 04 '23 at 17:17
  • I have to admit the Ontrack tool seems to be better than the others and even faster. Sadly, most of found pictures are older than the lost ones and most of them were (probably) deleted on purpose while doing deduplication. That only increases my feeling of them not being deleted. – adrianjgp Oct 04 '23 at 17:38
  • The problem with that is that there is no way to do it. hiding files can only be done one of two ways, at the file system driver level, or the application viewing. Using the CMD method rules out explorer (And confirms they are not there) It IS possible they could have been moved, but a simple search of the whole computer should find them and point that out quickly. Do you have any reference to how much data was in use on your disk prior to, it shrinking would be another clue of deletion. Not shrinking indicates they may have been relocated. – GeneMoody-Action1 Oct 04 '23 at 18:23
  • I don't have a real reference of the size of the content or the disk usage. I can only recall that the size was about 20GB and that the use bar in the explorer has steadily increased without me having done large data wipes. The only remaining option is that the files have been moved and maybe renamed, so I will try to search again using a file dedupe tool comparing with a few potential match files. If that doen't work, I'll have to accept the loss. Dissapointing, since it required several days of painful download and work. Besides, I don't have most of the source links any more. – adrianjgp Oct 04 '23 at 19:21
  • Update on my story. I didn't give up. I downloaded some of the files that should be in the lost data and tried to search a duple with Duplicate File Finder without success. The last attempt was to search a segment of one the files in the whole disk using WinHex Forensic hex editor to locate the potential disk sector and Windows fsutil to retrieve the file path. I couldn't take full advantage of these tools, but they got a real duplicate not found before... the browser cached version of the copies I used to compare. Here I ran out of ideas. – adrianjgp Oct 06 '23 at 01:33
  • This question was useful with the hex search. How do I determine what file occupies a given sector? – adrianjgp Oct 06 '23 at 01:36
  • Cool, I have used xways products for a long time in data forensics. Very powerful editor, IMO, the best. Winhex would show you in the file browser as well if the file had been "deleted" it would show slightly faded out. That is pretty much a confirmation the data is no more. wish I could have helped more. – GeneMoody-Action1 Oct 06 '23 at 02:08