Files and folder suddenly disappeared

Question

I've seen some similar threads but the solutions proposed doesn't work with my problem, so I'll have to create a specific question.

Windows 10 user. Yesterday I lost some files. I created a new folder, I put the files in it, and... well, they disappeared, both files and the folder. I tried to search in the computer, tried to show hidden files, checked the disk if there were errors or corrupted file system, checked the recycle bin, rebuild index option... nothing wrong, and my files were still gone.

Finally I downloaded and installed a recovery software (MyRecover) and I found out my files had been deleted: there were two rows for each file: one without the path from where they were deleted, the second deleted from C:$extend$deleted directory. Since I didn't mind to recover them (I was going to delete them anyway), I simply ignored them, but still the doubt remained.

I tried to check the system with some antivirus: Malwarebytes, Windows defender and Avast didn't find anything, while Kaspersky Anti-Ransomware Tool found a threat in a folder in user\Appdata\roaming named AppData\Roaming*osdmnuu_dir*. I manually fix it with UnHackMe, but I don't know if that threat could be responsible for what happened to my files.

 

Is it possible for a malware to act in the way I described? It seems so odd to me… in this case the files are gone or have been stolen?

Otherwise what else could have happened to my files?

 

Again, I was going to delete them anyway, so it's not a problem for the data loss, but I can't figure out what happened, and I want to make sure this will not happen again.

Answer 1

Hello,

You can enable the folder's audit and audit policy to record the corresponding logs for troubleshooting. You can refer to the following steps:

1.On the computer where the problem occurred, enter gpedit.msc with win+R to enter the "Local Policy Editor";

• Go to the "Advanced Audit Policy" settings as shown below: In Computer Configuration -Windows Settings -Security Settings -Advanced Audit Policy Configuration, set and enable "Audit File Share" and "Audit File System" in "Object Access";

• After the setting is completed, open CMD with administrator rights and execute the command: gpupdate /force;

• Run the following command again to check whether the audit policy is set successfully:

Auditpol /get /category:*

2.Set the audit in the problem file path:

Right-click the path to the problem folder, click "Properties", click "Security", click "Advanced":

Click "Auditing" and then "Add"

Add everyone, set and check as shown below, the applicable scope is "This folder, subfolders and all files", click "OK";

In this way, any access to subfolders and subfiles under the problem folder will be recorded in the Audit log, and the Audit log is in the "Security Log" of the event log to find out who deleted the file.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

Best regards

Zunhui

Answer 2

I'm stuck with