Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Can't Move Files From One HD To Another


  • Please log in to reply
6 replies to this topic

#1 pcklutz

pcklutz

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:54 AM

Posted 05 July 2010 - 01:15 PM

RE: "HD Crashed, How to find files you've hidden on old OS drive when old OS drive is now slave?"
Especially reply by hamluis to post by BRETMJ1 on 17 May 10

I have the same problem except my HD was infected with AV Security Suite. Was in a Dell GX270 running XP Pro (thought to be SP3). Put that HD in a USB case and connected to another GX270 running XP Pro where it is now E:. I am Administrator (w/o password) on both PCs and there are no User accounts. Disk properties says ~53 GB is used but the file list shows only ~12.6 GB.

Simple File Sharing is disabled on both C: and E: drives. Went thru the Take Ownership procedure on the E: drive. Administrator with Full Control is now exactly the same on both drives. All the Allow items on the Security-Advanced tab for both drives are checked. Have you any ideas on how I can get at the hidden 40 GB of folders and files? (I have not changed anything on the infected HD but I have a Ghost image of it. Image is ~51 GB.)

Screen dump is attached.

Suggestions will be greatly appreciated.

Attached Files



BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,231 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:54 AM

Posted 05 July 2010 - 01:27 PM

Well...a screen shot from Disk Management which reflects the old drive as an external...would tell us more.

Some Dells have recovery/restore partitions which might not be reflected anywhere other than Disk Management...because they are designed to be invisible to Windows.

And this does not apply to files which have been deliberately hidden, using file encryption, by a user.

FWIW: BC has a removal guide for AV Security Suite which you may want to read, http://www.bleepingcomputer.com/virus-remo...-security-suite.

Louis

#3 pcklutz

pcklutz
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:54 AM

Posted 08 July 2010 - 10:25 AM

hamluis
Attached is a PDF of the Disk Management screen. It does not show E: to be an external drive but it is. Is there another screen that you expected to see?

Will have to study the tutorial on Removing AV Security Suite later. If I can get my files off the drive, I will just reformat the infected drive. Wasted too much time on it already. I got stung on a widely recommended removal tool, PC Tool's Spyware Doctor 2010. Purchased it from the PC Tools website. It not only failed to see any problem with the infected drive but it installed a trojan on my new laptop (as reported by AVG Security Suite). GeekSquad wanted $200 to remove AVSS, another shop said they would have to clear everything off the drive and reload everything. Didn't care for either solution. My important files were backed up a few days before the infection but there were many other files that I would like to recover if possible.

Attached Files



#4 sbdblyss

sbdblyss

  • Members
  • 58 posts
  • OFFLINE
  •  
  • Local time:08:54 AM

Posted 08 July 2010 - 10:37 AM

Since you already have ownership of the drive, I would suggest using Recuva. Recuva will at least tell you if the files are on the drive, but simply not visible in the file tree. http://www.recuva.com. It is free for personal use.

Jake
My mind isn't quite sure what it has bargained for, but my heart is in time with, with the consistency of Your's.

#5 hamluis

hamluis

    Moderator


  • Moderator
  • 55,231 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:54 AM

Posted 08 July 2010 - 10:53 AM

Thanks :thumbsup:.

From what I see, the 80GB drive has only one partition (a former system partition, hence it's noted as Active)...no hidden partitions.

<<Disk properties says ~53 GB is used but the file list shows only ~12.6 GB.>>

You can use any number of tools to see what's taking up space, including one of the following:

TreeSize Pro Trial - http://www.jam-software.com/treesize/

WinDirStat - http://download.cnet.com/WinDirStat/3000-2...4-10614593.html

You should be able to move any files from that drive easily...other than those files which are in Documents & Settings Folders. The files in those folders...are the only ones where taking ownership applies.

All files should be visible, it's only access that is restricted and requires taking ownership.

Louis

#6 pcklutz

pcklutz
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:54 AM

Posted 12 July 2010 - 12:38 PM

hamluis and sbdblyss

TreeSize Pro - displayed the files I needed and their locations; said Access Denied
WinDirStat - did not display the files
Recuva - did not display the files even using the Deep Scan option

Success. Problem was related to ownership. I used the info in Microsoft Knowledge Base article http://support.microsoft.com/kb/810881 to finally resolve the problem. Early on, I had taken ownership of the drive and checked on "Replace owner on subcontainers and objects". Close but not there yet.

Success was finally achieved when I went thru the ownership process for each folder on the drive.

I may play around with the drive later to see if I can uninfect it but for now I am a happy camper.

Thank you for your support.

#7 hamluis

hamluis

    Moderator


  • Moderator
  • 55,231 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:54 AM

Posted 12 July 2010 - 12:57 PM

Glad you were able to resolve it, happy computing :thumbsup:.

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users