Recently, my co-artist asked me why the files and folders of his USB flash drive were lost. Then I came to check his flash drive, I’ve found out that his files and folders were just trickily hidden.
Why do I say so that his files and folders were just trickily hidden? It is mainly because when I’ve tried to check the used memory space of his flash drive it was not ZERO (0) MB, thus, it simply implies that his flash drive has still the files and it’s just trickily hidden. No doubt this is caused by a “VIRUS” which alters one or more file attributes (such as read-only, archive, system, hidden) that’s why it was hidden. But the thing is we need to recover our files right? So we need a solution to unhide the hidden files and folders caused by the virus. We’ll make use of the attrib command to do this.
The attrib Command (Source http://en.wikipedia.org/wiki/ATTRIB)
attrib is a command, in DOS, OS/2 and Microsoft Windows. The function of attrib is to set and remove file attributes (read-only, archive, system and hidden). These attributes are used by a wide variety of software programs to protect and classify files.
Many users regularly encounter the read-only attribute, which will prevent most software from allowing the user to overwrite or append to a file. Software can be designed to override this option, often after receiving confirmation from the user. The archive attribute is used by various backup and file copy programs as a hint as to whether a file needs to be backed up.The hidden attribute makes affected files invisible in many programs, although a variety of software, especially software designed for listing, viewing, and searching files, allows hidden files to be made visible, often with a notation that they have been designated as hidden. The system attribute is used to designate certain operating system files and affects the operation of most software less than the other attributes.
There are four attributes in Windows files:
- (r) Read-only file attribute
- (a) Archive file attribute
- (s) System file attribute
- (h) Hidden file attribute
One or more of these attributes can be set [+x] or cleared [-x] in a single instance of the command for a specific file, file type, folder or and entire branch of the directory structure (a directory, including all sub-directories). There are three optional switches that can be applied at the end of the DOS command string, although not all switches are recognized for all versions of Windows. These switches are:
- /S also apply changes to subdirectories of current directory
- /D also apply changes to folder names (this only applies for Windows 2000 and Windows XP)
- /L apply to symbolic link itself instead of the target of the symbolic link (introduced with Windows Vista and Windows Server 2008)
The general attrib command syntax is:
- attrib [+r|-r] [+a|-a] [+h|-h] [+s|-s] [d:][path]filename [/s] [/d] [/l]
For example, to remove the read-only and hidden file attributes for all files in a directory tree:
- attrib -r -h *.* /s /d
Note, the -s parameter will also remove the system attribute for files and should always be used with care and should not be used for genuine system files.
In certain versions, when both the s and h attributes are both set, they can only be removed at the same time. Therefore, to remove only one, both must first be removed, and then the desired attribute can be (re)set, for example
C:\> attrib -S -H *.*
The command will not clear the Read-Only flag from hidden files and will report that the flag was not cleared on each file.
Differences between Windows versions
The “/D” switch (which recurses into sub-directories) was introduced with Windows XP and Windows Server 2003, and “/L” (which instructs attrib to work with the attributes of the symbolic link itself instead of the target of the symbolic link) was introduced with Windows Vista and Windows Server 2008.
- Open “Command Prompt“, Go to Start (the windows logo located in the bottom left corner of your screen if you are using Windows 7) > All Programs > Accessories > Command Prompt. Alternativley, hold the “Windows logo” and press the “r” key (Windows logo + r) on your keyboard to open the Run dialog box and type cmd.
- Enter the appropriate drive letter of your USB flash drive into the command prompt, in case your flash drive is G, simply type G: and press Enter
- Type attrib -r -a -s -h *.* /S /D (This command removes all the file attributes set on every file and folders stored in your flash drive) and press Enter
- See image below.
- In case you can not still see the hidden files in your flash drive please follow the steps on How to Hide and Unhide Files and Folders.
Thank you for reading. Please leave a comment if you still have problems regarding this. I’ll be pleased to answer it. Godspeed! (4003 views)