The drive still shows used space, but folders are gone? USB malware can change file attributes and hide legitimate content without necessarily deleting it.
Hidden does not mean deleted
Windows uses attributes such as Hidden and System to control file visibility. Some malware abuses those attributes to hide real folders while placing shortcuts or executables in their place.
How to distinguish data loss from hidden content
Compare total capacity with free space, temporarily inspect hidden items, and scan before moving or deleting files. Used space can indicate that content is still present, but there can be other explanations.
Remove the cause before restoring visibility
Restoring attributes while the responsible process or persistence remains active can make the issue return. Treat Windows and the external drive as parts of the same incident.
After remediation
When applicable, ANTÍDOTO can restore abnormal attributes on legitimate items after neutralizing supported artifacts. The result should be checked with a fresh scan and manual verification of important data.
Before destructive operations, keep a backup of important data whenever possible.
Scan first. Decide after.
ANTÍDOTO shows the detected indicators before remediation.