Awoke to find two folders deleted.

19543261

As title reads.

I thought perhaps I was going blind when I couldnt locate two folders in My Documents, but I checked MFT through the program "Directory Snoop" and indeed they had been deleted the previous night at roughly the same time "[Anime - Currently Watching] at 22:07:00:93 [Downloads] at 22:07:01:06" Thats about 25gb worth of files gone.

To clear a few things up:

Nothing has gone missing before.
HDD hasn't been acting up lately or anything; ran a disk check and came up clean.
I was present in the room at the time, no one was at my computer.
Ran Spybot - Search & Destroy came up clean.
Ran Ad-Aware came up clean.

I cant see how this could be anything malicious. No system files seem to have been affected; nothing of great importance was lost and they certainly werent the largest folders I have.

Here's where it gets really odd. I tried to recover some of the missing files with TuneUp Utitlites and only 3 that were in both of those folders turned up along with files deleted ages ago. How can this be? Why would there be no record of so many files deleted only a few hours previous, yet some from months ago remained? When I first scanned the drive with Directory Scoop it shown both of the folders in red and gave me the times of their deletion. After recovering one of the files, it told me to rescan the drive. After that it no longer showed the [Downloads] folder at all, and only a handful of the files in the other were shown along with some older ones. This essentially means I only have my memory to serve me in acquiring these files again. Considering how many files there were, this will be one hell of an arduous task (Im unlikely to remember even 1/4 of them!)


I worry this might happen again at anytime and Ill lose something far more important. If I was to write protect individual folders would I do so for the Admin and the System? Also considering this will mean I wont be able to use the folder as normal, is there any other less awkward ways to protect folders from deletion? Im not in a position to buy another HDD for backup at the moment so thats the only precaution I can see that I could take.

...Anyone any ideas of the cause in the very first place? Because Im scratching my head here, folders cant up and delete themselves.

Thanks in advance.

Odaise Gaelach

I had a similar problem a while back, whereby a folder in my Downloads folder was deleted without warning.

The only programs (apart from Windows itself) that would have been accessing those folder would have been Windows Media Player and uTorrent. Since I've not had something similar happen to other folders that Windows Media Player would have been writing to, plus since the only program that would have been writing to them would have been uTorrent, I can only conclude that it was uTorrent that caused the problem. Luckily for me I had a backup, so I could restore what I lost.

I don't know how relevant that is to you, but that's my experience anyway.


Regardless, run a full anti-virus scan and maybe chkdsk as well, just to rule out malware and hardware failure.

19543261

I appreciate the reply, Odaise.

Thats interesting. My torrent client is BitTorrent and it definitely would of been accessing specifically those two folders of mine a lot in the past. Whether this is just a coincidence or not Im not sure, but it would of been writing only to my external last night, and there's no problems there...It would have been seeding though.

Odaise Gaelach wrote: »

Regardless, run a full anti-virus scan and maybe chkdsk as well, just to rule out malware and hardware failure.

Was the very first thing I did. Both very unlikely anyway.

I'm messing around with security permision on my folders. Is there any reason why I wouldnt want to disable SYSTEM permission? I dont see why it would need it anyway. Also, when I deny permission to "delete" and "delete files and subfolders" only, Im unable to rename/move files. Why is this?

19543261

I hope someone else might have some insight...

hearny

They may have been corrupted.
Did you have to scan the hard drive with chkdsk or similar program.

Open My computer, Go to the Hard drive in question.

Click on tools -> Folder Options

Select the View tab and make sure to selet
show hidden files and folders

and untick

hide protected operating system files.

click ok.

On the root of the drive do you have a folder called found.000 (or similar)
If there are look in these folders to see if you have your missing files.

Go back into the view options above and reverse the changes you made in folder options.

19543261

Thanks, hearny.

I began a disk check myself. I have those folder options set as such by default, so I located that folder and found only 3 files: file0000.chk, file0001.chk, file0002.chk. They're all 0 bytes.

The MFT recorded the two missing folders deleted. Would they be deleted by the system if they became corrupt? Again, to quote myself:

When I first scanned the drive with Directory Scoop it had shown both of the folders in red and gave me the times of their deletion. After recovering one of the files, it told me to rescan the drive. After that it no longer showed the [Downloads] folder at all, and only a handful of the files in the other were shown along with some older ones.

Is there no way to review what initiated the deletions? Surely there's a more detailed account other than the MFT that deals specifically with deletions, or even some kind of digital trail to see the cause.