When documents disappear from a USB drive, that does not prove they were deleted. Some USB/LNK infections hide or move legitimate content and leave shortcuts visible instead of the original folders.
What to look for
Compare used storage space with the number of visible files. Substantial used space with few visible folders warrants investigation, but filesystem corruption or another unrelated issue is also possible.
Preservation comes first
Do not format the drive as a first step. Avoid copying suspicious shortcuts to other computers and, where possible, preserve a backup of legitimate documents before changing attributes or moving folders.
Recovery in V1.6.3 testing
In controlled MAYUNDO scenarios, ANTÍDOTO identified hidden or displaced legitimate content, preserved valid files and recovered the affected documents folder. This evidence is limited to the scenarios actually tested.
When to seek specialist help
If the drive shows physical errors, makes unusual noises, is not recognized or requests formatting, stop repeated write attempts. Those signs may require specialist data recovery.
Related reading
- Checklist: what to do when you suspect MAYUNDO on a USB drive
- MAYUNDO: how to preserve documents before cleanup
A safer scan with ANTÍDOTO
If you recognize these symptoms, you can download ANTÍDOTO and run a free scan of Windows and external devices. Review the findings before deciding on remediation, which requires a license. See the licensing plans and Resource Center. Detections and outcomes depend on the individual case.