All pictures missing on Win8 Machine

[marcplante]

My wife runs a Windos 8.1 Samsung Notebook. Today, she discovered that all pictures on her hard drive have disappeared. She has run AVG antivirus to identify a virus and the computer runs Malwarebytes licensed to watch over the PC full time. Neither found any sort of a virus.

She has a separate D: partition that has images that have not been affected.

Went into file manager and assured that flags for hidden files not set.

System restore did nothing.

Anyone BTDT.

Thank you,

Marc

 

[marcplante]

tried running an attrib -h command and getting a large wave of access denied in the CMD window.

 

[Ketchup]

tried running an attrib -h command and getting a large wave of access denied in the CMD window.

I hope that was a dir command. Maybe there were misplaced, or accidentally deleted. A few ideas:

Place a *.jpg (assuming they are jpegs) in the search window and let Windows search each drive. Make sure they weren't misplaced.

Did you search the recycle bin?

If you know what folder they were in, you could try the restore previous version option.
http://windows.microsoft.com/en-us/windows7/recover-lost-or-deleted-files

Recuva is a good tool for finding deleted files (so long as they haven't been written over).
https://www.piriform.com/recuva

You said that you completed a scan with AVG. Did you look in it's Virus Vault) to see if there are any pictures in there?

 

[marcplante]

Did all of those things. Did directory searches at the command line level and tried using the attributes command to unhide files. Bitdefender scan noted that there were 1500 folders that were password protected and unavailable for scanning. I'm going to use windirstat to size that mess, then use cryptowall scanning tools found on bleepingpc to locate any locked archives

Sent from my SM-G900V using Tapatalk

 

[VirtualLarry]

Bitdefender scan noted that there were 1500 folders that were password protected and unavailable for scanning.

!!!

I'd look into that. Sounds like ransomware to me.

 

[marcplante]

Looks like we dodged a bullet. File recovery software was able to recover deleted copies of almost all of the pics. Need to make sure my wife is running as regular user in the future, not admin. Might even be time to explore VMWare.

Sent from my SM-G900V using Tapatalk

 

[Ketchup]

If you are SURE the files weren't accidentally deleted, VL makes a valid point. In which case, you would want to wipe the drive and re-install. Run virus and malware scans on every computer on your network.

In any case, make sure you important files are backed up on drive outside of the PC.