Recover USB data from Virus and Malware Infection

Data loss is a great threat to our digital age. Different variants of malware are developed for the purpose of infecting your device and threaten your data security. Popular malware that alarmed the world and made headlines is the Wannacry which is a trojan, a worm, and crytomalware.

We relied on increasing storage for our files which become cheaper for bigger storage capacity. One of which is USB flash disk. Almost everyone using computer have these portable and useful storage media. It is a removable device with typical capacity between 1Gb to even Terabytes.

No wonder people store their important data on this device. We rely on the storage very much that we always want to recover the precious data saved on it, not minding on the device cost when we either lose our USB or it simple become unreadable. Virus causes data loss as we know it.

Here are ways to recover data for some type of malware infection:

1. Hiden Files

Our USB will not show the list of files it contains. 

2. Weird Files and Folders suddenly appearing

It will show either as blank folder, unknown files with unknown file formats or weird shortcuts.

3. Your Files and Documents turned into an Executable File

Clicking the altered files would trick the user into running the virus on their PC. Doing so will spread the infection.

Okay. You see the following signs that your files are messed up by the virus. How can you retrieve it then? The following steps below will significantly help you recover your data. These are common instructions a typical user with computer can do with the need of advance tools.

1. Check if the storage used size is not small

On your computer, go to Computer (for Win 7) and check your drive if it still shows the original used space before the drive is infected by virus. If it shows that the drive is blank, then you would need to run data recovery software to recover the files. Do not use the drive in writing new data as the lost data from the drive will be overwritten with the new data. 

2. Same size of storage used

If it shows the original size, then the files are still there on the drive. Check if you are infected with ransomware. Ransomware infected files will show readme section with the note that you are infected by a ransomware. If it is not ransomware, then recovering your data would be easy. Run the following commands in the command prompt to show hidden files and reset files attributes:

cd (drive letter):

attrib -r -a -s -h *.*

Drive letter is the assigned letter to your USB. You can verify from Computer, look for your drive name and check the associated drive letter.

Check if the files are restored. Congratulations.

If data still does not show, there must be a folder name illegal character that prevents File Explorer from showing the file. Download WinRAR software and install to your PC. It has free evaluation trial which you can use to find your hidden folder.

WinRAR is the world's most popular RAR archiver and  extractor. If you already have it installed on your PC, open the program. Navigate into Computer, then select your flash drive. If it is the case that the data is hidden inside a folder with an invalid folder name, ex. underscore, then you should see it listed under WinRAR file explorer. When you are sure the data is inside the folder, click Add button fromt he WinRAR menu and set the location to a secure and virus free storage location. Do not save on the same flash drive since you probably want to format your USB. When done, extract the RAR file you created and your files should be there.