Solved Files suddenly disappeared from hard drive

March 14, 2018 at 07:44:14
Specs: Windows 7 x64, i5-3570, 8GB RAM
Today, without any interference from my side, some folders with files have gone suddenly missing from my main internal hard drive. The losses constituted around 30-40% of the hard drive's content, mainly affecting the majority of video files, some programs/games and system backup files, which took up around 250 GB of space in total. However, the disappearance seemed to be generally random, as some folders have vanished completely, while others are just missing some contents.

I'm using Windows 7 x64 (i5-3570, 8GB RAM) and Kaspersky Total Security 2017 as my antivirus of choice. I've been using and paying for the antivirus for around five years now, and never really had a major issue with malware/viruses in general. I'm also using two drives:

1) SSD ADATA, which contains the Windows 7 OS and the browser I'm using, and which seemingly hasn't been affected by the issue

2) HDD Western Digital 1TB (ATA WDC WD10EZEX-00W SCSI), from which the files have disappeared

The disappearance of files happened while I was at the computer. I have absolutely no idea what could've caused it, and the only thing that, in my view, could have affected it right before I noticed was the latest Windows 7 security update:

Definition Update for Windows Defender - KB915597 (Definition 1.263.492.0)

It's one of the defender updates I manually install every few days and which usually doesn't lead to anything special.

After the files and folders had gone missing, I immediately restarted the PC a few times, checked the whole PC for malware using utilities and software, such as Malwarebytes, AVZ, rkill, and some others, and even launched a rescue disk to make an independent of the OS malware check, which didn't yield anything of value.

The hard drive I'm using was purchased a year and a half ago, and is Western Digital 1TB (ATA WDC WD10EZEX-00W SCSI). I've ran some hard drive health monitoring software, including integrity and S.M.A.R.T. checks, which haven't revealed any issues. I've ran the CHKDSK a few times as well, including the one requiring reboot. I've also tried some other things, like "unhiding" the folders in the Windows folder settings and re-indexing the whole hard drive. Furthermore:

- Recuva doesn't show the majority of missing files and folders in the recovery list
- All the icons to the deleted programs are "broken", indicating that files are, in fact, gone
- I've checked the whole size of the currently present files, which matches the total taken space on the hard drive
- Some registry leftovers do still link to some of the disappeared programs, but CCleaner recommends to remove them as they don't actually connect to real files
- I've checked files in quarantine places (Windows Defender/Antivirus), but found nothing

So far I'm suspecting that it could've been either the Windows Update that malfunctioned critically, or the hard drive itself, which is far less likely.

My question is:
Does anyone know what happened in this case?

message edited by Frank213


See More: Files suddenly disappeared from hard drive

Report •

✔ Best Answer
March 16, 2018 at 10:06:48
I don't know anything about Photorec so proceed with caution. I don't think photorec has any relationship with testdisk. Use the link above for the tutorial and the link below this response for the download of testdisk.

Testdisk is safe to use but you MUST read the tutorial first. I have not used it to try recovering individual files though. Did you notice that testdisk has an .org file extension. That means not for profit, or non-profit. I trust those types more than commercial.

I assume you regularly backup your personal files at the very least. Always good practice to do that prior to performing any actions like testdisk. If you don't currently have an external hard drive for backup purposes, I suggest you get one. Also, writing to your internal drive at this point MAY overwrite lost files. I suggest a a complete partition backup to the external prior to messing with any recovery programs.

Recuva can also selectively search for deleted/ lost files by using askerisk followed by a period then the file extension IE/ *.MPEG4.

Were the files in question legally downloaded or from a warez site. Windows sometimes can wipe illegal files/software. Do you use Windows Update with automatic settings? I recommend allowing Windows to download the updates and notify you in the tray that they are available. Also, I do not accept hardware driver updates from Microsoft. Get those from the manufacturer. Hope this helps.

https://www.cgsecurity.org/



#1
March 14, 2018 at 09:09:58
All i can think off it that the drive is starting to fail...

try running this command form cmd.exe & tell us the results:
wmic diskdrive get status

i5-6600K[delid]@4.814GHz/4.613GHz cache@1.385v | 2x4GB Crucial-DDR4-2133@14-14-14-28 1T 2808MHz@1.35v
ASUS Z170K
Samsung 250GB SSD 850 EVO
MSI Armor RX 570 4GB@1375c/1910m BiosMod
VS450


Report •

#2
March 14, 2018 at 09:18:47
Thanks for the reply!

I've just ran the command, and it showed that the status for all drives is "OK". Plus, I've ran many hard drive checks and none of them indicated anything suspicious. I still think it's either Windows Defender or the Windows update that messed something up.

Also, the drive was purchased a year and a half ago, so I highly doubt it would start failing so early.

message edited by Frank213


Report •

#3
March 14, 2018 at 10:01:18
Go to Windows Disk Management and post all information listed there for that hard drive. I don't believe you should be using both Kaspersky Total Security 2017 and Windows Defender at the same time. That may be your issue as both have AV elements. See the link from MSoft on Defender.

https://support.microsoft.com/en-us...


Report •

Related Solutions

#4
March 15, 2018 at 02:22:39
Thank you for the reply, OtheHill!

I've just checked the Windows Disk Management panel for the drive and there's not much information to post about. It pretty much only says "Simple, Basic, Online, Healthy (Primary Partition)" about the drive.

And I think you are right about the Defender, as I suspect it as the main culprit. I've already disabled it and won't touch it again, including its updates.


Report •

#5
March 15, 2018 at 11:51:45
What does disk management show for total space and used or remaining space and partition type (NTFS or FAT 32)?

You could try running testdisk for file recovery. See the tutorial link below.

https://www.cgsecurity.org/wiki/Tes...


Report •

#6
March 16, 2018 at 01:38:50
Total space is 931 GB, remaining space is 663 GB, partition type is NTFS.

I'm looking at TestDisk/PhotoRec right now and I'm not sure if this is completely safe to use. Do you think there's any risk involved in using this software? Can it potentially damage the drive settings or the remaining data while looking for/recovering lost files?

I also don't exactly understand the difference between TestDisk itself and PhotoRec. Can't TestDisk recover video files as well?

message edited by Frank213


Report •

#7
March 16, 2018 at 10:06:48
✔ Best Answer
I don't know anything about Photorec so proceed with caution. I don't think photorec has any relationship with testdisk. Use the link above for the tutorial and the link below this response for the download of testdisk.

Testdisk is safe to use but you MUST read the tutorial first. I have not used it to try recovering individual files though. Did you notice that testdisk has an .org file extension. That means not for profit, or non-profit. I trust those types more than commercial.

I assume you regularly backup your personal files at the very least. Always good practice to do that prior to performing any actions like testdisk. If you don't currently have an external hard drive for backup purposes, I suggest you get one. Also, writing to your internal drive at this point MAY overwrite lost files. I suggest a a complete partition backup to the external prior to messing with any recovery programs.

Recuva can also selectively search for deleted/ lost files by using askerisk followed by a period then the file extension IE/ *.MPEG4.

Were the files in question legally downloaded or from a warez site. Windows sometimes can wipe illegal files/software. Do you use Windows Update with automatic settings? I recommend allowing Windows to download the updates and notify you in the tray that they are available. Also, I do not accept hardware driver updates from Microsoft. Get those from the manufacturer. Hope this helps.

https://www.cgsecurity.org/


Report •

#8
March 16, 2018 at 10:38:51
Thanks for such a detailed answer.

I've pretty much just accepted that I won't get the files back and restored my previous system backup, just to be safe. I've disabled all windows updates and windows defender as well. I think I'm not going to bother with Testdisk as of right now, but I am saving it to use it at a later time if I will need it, and, again, thanks a lot for your help!

message edited by Frank213


Report •

#9
March 16, 2018 at 11:12:49
OK then, as long as you have a full image of your entire partition to play with you don't risk much.

You do need to apply updates, just review them before hand. And as I stated above, be selective. Windows OS, yes, hardware and/ or third party software updates from MS, no.


Report •

#10
March 16, 2018 at 23:08:00
Why do you think Windows updates are important at this stage? Won't the antivirus protection be enough?

Report •

#11
March 17, 2018 at 09:42:57
Updates may include patches to Windows vulnerabilities. Also, Updates to IE.

Report •

Ask Question